CVE-2025-35979: Intel Processors Information Disclosure in Microarchitectural Predictor State

CVE-2025-35979 · Severity: info · CVSS 6.8 · Published 2026-05-12

A security vulnerability in certain Intel processors could allow a malicious user to access sensitive information from other users or virtual machines on the same system. This issue stems from how the processor predicts future instructions, which can inadvertently leave traces of private data in shared hardware components. While the attack is complex to execute, it could lead to the theft of passwords, encryption keys, or other confidential data. Intel has released microcode updates to address this issue, and users are advised to update their system firmware (BIOS).

Technologies: Intel Core Ultra Processors Series 2, Intel Core Ultra Processors Series 3. Vendors: Intel.

Quick answers

Is CVE-2025-35979 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-35979 being exploited in the wild.
How severe is CVE-2025-35979?
Informational severity, with a CVSS score of 6.8, published 12 May 2026.
Which products and versions are affected?
Intel Core Ultra 200S Series Processors (Arrow Lake); Intel Core Ultra Processors Series 2 (Lunar Lake); Intel Core Ultra Processors Series 3 (Panther Lake).
Is there a fix for CVE-2025-35979?
A patch was published on 2026-05-12: Microcode updates released via INTEL-SA-01420 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-35979 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2025-35979?
Check whether you run Intel Core Ultra 200S Series Processors, Intel Core Ultra Processors Series 2 or Intel Core Ultra Processors Series 3. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a transient execution side-channel attack involving shared microarchitectural predictor states within VMX non-root (guest) operations. An unprivileged local attacker with authenticated access can exploit shared predictor states to influence transient execution and observe sensitive data across security boundaries (e.g., from a guest VM or another process). The attack is characterized by high complexity and requires specific architectural preconditions to be met. Intel has addressed this via microcode updates (INTEL-SA-01420) for affected Arrow Lake, Lunar Lake, and Panther Lake platforms.

Affected products

  • Intel Core Ultra 200S Series Processors (Arrow Lake)
  • Intel Core Ultra Processors Series 2 (Lunar Lake)
  • Intel Core Ultra Processors Series 3 (Panther Lake)

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: patched: Microcode updates released via INTEL-SA-01420

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.