CVE-2026-20728: Intel Extension for TensorFlow privilege escalation flaw in Ring 3

Summary

CVE-2026-20728 is a protection mechanism failure in some Intel Extension for TensorFlow software before version 2.15.0.3, within Ring 3. User applications may allow an escalation of privilege. A system software adversary with a privileged user, combined with a low complexity attack, may exploit it via local access when attack requirements are present, without special internal knowledge and with passive user interaction. The source rates the impact on the vulnerable system as high confidentiality, integrity and availability, with no subsequent system impact.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database
• MediumAI found Linux kernel bugs that remained undetected for decadesSimilar attack · CSO Online
• InfoInside an AI Attack Against a US RetailerSimilar attack · Dark Reading
• HighCVE-2026-67547: taOS remote code execution via skill-exec endpoint for non-admin usersSimilar attack · NVD/CVE Database
• MediumCVE-2026-65957: Helio dashboard CORS origin validation bypass via private-network prefix matchSimilar attack · NVD/CVE Database