# CVE-2026-20782: Intel QAT software drivers buffer overflow in Ring 3 applications

Source: https://junglewise.ai/threats/cve-2026-20782-intel-qat-software-drivers-buffer-overflow-in-ring-3-applications  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-20782 · Severity: medium · CVSS 6.6 · Published 2026-05-12

Intel QuickAssist Technology (QAT) software drivers, which are used to accelerate cryptographic and data compression workloads, contain a security vulnerability. A local user with basic access to a system could exploit this flaw to cause the software to crash or become unresponsive. This would disrupt services relying on QAT acceleration and could lead to a full denial of service for those applications.

Technologies: [Intel QAT software drivers for Windows](https://junglewise.ai/threats/technologies/qat-software-drivers-for-windows), [Intel Quickassist Technology](https://junglewise.ai/threats/technologies/quickassist-technology). Vendors: [Intel](https://junglewise.ai/threats/vendors/intel).

## Quick answers

**Is CVE-2026-20782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20782 being exploited in the wild.

**How severe is CVE-2026-20782?** Medium severity, with a CVSS score of 6.6, published 12 May 2026.

**Which products and versions are affected?** Intel QAT software drivers for Windows before 1.13; Intel QuickAssist Technology software drivers for Windows before 1.13.

**Is there a fix for CVE-2026-20782?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20782 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-20782?** Check whether you run Intel QAT software drivers for Windows, Intel QuickAssist Technology software drivers for Windows or Intel Quickassist Technology at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in certain Intel QuickAssist Technology (QAT) software drivers for Windows within Ring 3 (User Applications). The vulnerability is triggered by improper input handling when copying data to a buffer without adequate size verification. An authenticated, unprivileged local attacker can exploit this with low complexity and no user interaction. Successful exploitation primarily impacts system availability by causing a denial of service, though it may also result in low-impact compromises to confidentiality and integrity. Intel has released version 1.13 to mitigate this issue.

## Affected products

- Intel QAT software drivers for Windows before 1.13

## Timeline

- 2026-05-12: advisory: Intel released SA-01387
- 2026-05-12: disclosed: CVE-2026-20782 published

## References

- [https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html)

## Related threats

- [Intel QAT software drivers for Windows improper input validation](https://junglewise.ai/threats/cve-2026-20767-intel-qat-software-drivers-for-windows-improper-input-validation)
- [Intel QAT software drivers for Windows out-of-bounds write](https://junglewise.ai/threats/cve-2026-20714-intel-qat-software-drivers-for-windows-out-of-bounds-write)
- [Intel QAT software drivers null pointer dereference](https://junglewise.ai/threats/cve-2026-20914-intel-qat-software-drivers-null-pointer-dereference)
- [Intel QAT software drivers improper input validation in Windows](https://junglewise.ai/threats/cve-2026-20905-intel-qat-software-drivers-improper-input-validation-in-windows)
- [Intel QAT software drivers divide by zero in Ring 3 User Applications](https://junglewise.ai/threats/cve-2026-20881-intel-qat-software-drivers-divide-by-zero-in-ring-3-user)