CVE-2026-20880: Intel Graphics Driver privilege escalation in software installers

CVE-2026-20880 · Severity: info · Published 2026-11-10

Intel Graphics Driver installers have incorrect default file permissions that could allow a local attacker with an authenticated user account to gain elevated system privileges. An attacker would need to trigger the installer manually, but once successful, they could gain complete control of the system, potentially stealing data or installing malware.

Technologies: Intel Arc B-series graphics cards, Intel Graphics Driver for 7th-10th Gen Core processors, Intel Graphics Driver for Arc graphics, Intel Graphics Driver for Arc Pro graphics, Intel Graphics Driver for Data Center GPU Flex Series. Vendors: Intel.

Quick answers

Is CVE-2026-20880 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20880 being exploited in the wild.
How severe is CVE-2026-20880?
Informational severity, published 10 November 2026.
Which products and versions are affected?
Intel Arc B-series graphics cards B570, B580; Intel Graphics Driver for 7th-10th Gen Core processors before 31.0.101.2141; Intel Graphics Driver for Arc graphics before 32.0.101.8629; Intel Graphics Driver for Arc Pro graphics before 32.0.101.8517; and 2 more.
Is there a fix for CVE-2026-20880?
Yes: fixed in Graphics Driver for Arc graphics 32.0.101.8629; Arc Pro graphics 32.0.101.8517; Data Center GPU Flex Series 32.0.101.8331; 7th-10th Gen Core, Atom, Pentium, Celeron 31.0.101.2141. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20880 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20880?
Check whether you run Intel Arc B-series graphics cards, Intel Graphics Driver for 7th-10th Gen Core processors, Intel Graphics Driver for Arc graphics or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Graphics Driver for Arc graphics 32.0.101.8629; Arc Pro graphics 32.0.101.8517; Data Center GPU Flex Series 32.0.101.8331; 7th-10th Gen Core, Atom, Pentium, Celeron 31.0.101.2141

Technical details

Multiple privilege escalation vulnerabilities (CVE-2026-20756, CVE-2026-20798, CVE-2026-20880, CVE-2026-26052) exist in Intel Graphics Driver installers due to insecure default permissions and uncontrolled search paths in Ring 3 user applications. These require local access with an authenticated user account and active user interaction (installer launch); an unprivileged attacker can escalate to system privileges to achieve confidentiality, integrity, and availability compromise. CVE-2026-21407 is a separate denial-of-service deadlock in Arc B-series device drivers.

Affected products

  • Intel Graphics Driver for Arc graphics before 32.0.101.8629
  • Intel Graphics Driver for Arc Pro graphics before 32.0.101.8517
  • Intel Graphics Driver for Data Center GPU Flex Series before 32.0.101.8331
  • Intel Graphics Driver for 7th-10th Gen Core processors before 31.0.101.2141
  • Intel Graphics Driver for Atom, Pentium, and Celeron processors before 31.0.101.2141
  • Intel Arc B-series graphics cards B570, B580

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.