CVE-2026-21387: Intel LLM Library for PyTorch privilege escalation flaw

Summary

CVE-2026-21387 is a protection mechanism failure in some Intel(R) LLM Library for PyTorch components running in Ring 3 (user applications). An unprivileged adversary who already holds a privileged user account can escalate privilege through local access, with low attack complexity and passive user interaction required. The flaw could impact confidentiality, integrity and availability of the vulnerable system at high levels, with no subsequent system impact stated.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoMicrosoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 NeuronsSimilar attack · The Hacker News
• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• InfoLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion PersonalizationSimilar attack · Arxiv (cs.RO + cs.CV security)
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide