# CVE-2026-20908: Intel NPU Driver Windows time-of-check time-of-use race condition

Source: https://junglewise.ai/threats/cve-2026-20908-intel-npu-driver-windows-time-of-check-time-of-use-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20908 · Severity: info · CVSS 5.8 · Published 2026-08-11

Intel's NPU (Neural Processing Unit) Driver for Windows contains a race condition in its device driver that allows an authenticated local attacker to cause a denial of service. The vulnerability requires high complexity to exploit and specific attack conditions, but could crash or freeze the affected system, disrupting dependent applications and operations.

Technologies: [Intel NPU Driver for Windows](https://junglewise.ai/threats/technologies/npu-driver-for-windows). Vendors: [Intel](https://junglewise.ai/threats/vendors/intel).

## Quick answers

**Is CVE-2026-20908 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20908 being exploited in the wild.

**How severe is CVE-2026-20908?** Informational severity, with a CVSS score of 5.8, published 11 August 2026.

**Which products and versions are affected?** Intel NPU Driver for Windows before 32.0.100.4723.

**Is there a fix for CVE-2026-20908?** A patch was published on 2026-08-11: Update to version 32.0.100.4723 or later available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20908 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20908?** Check whether you run Intel NPU Driver for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20908 is a time-of-check time-of-use (TOCTOU) race condition in the Intel NPU Driver for Windows kernel-mode driver component. The vulnerability allows an authenticated local user to trigger a denial of service by exploiting a window between a security check and the subsequent operation on a protected resource. The attack requires high complexity and specific preconditions to execute reliably. An attacker can cause system instability, crashes, or temporary unavailability of NPU functionality. The vulnerability has been patched in version 32.0.100.4723 and later.

## Affected products

- Intel NPU Driver for Windows before 32.0.100.4723

## Timeline

- 2026-08-11: disclosed
- 2026-08-11: patched: Update to version 32.0.100.4723 or later available

## References

- [https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01456.html](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01456.html)

## Related threats

- [Intel NPU Driver improper resource locking denial of service](https://junglewise.ai/threats/cve-2026-40705-improper-resource-locking-for-the-intel-r-npu-drivers-before)
- [Intel NPU Driver null pointer dereference denial of service](https://junglewise.ai/threats/cve-2026-32672-null-pointer-dereference-for-the-intel-r-npu-drivers-before)
- [Intel NPU Driver out-of-bounds read denial of service](https://junglewise.ai/threats/cve-2026-20786-intel-npu-driver-out-of-bounds-read-denial-of-service)
- [Intel NPU Driver improper conditions check in firmware](https://junglewise.ai/threats/cve-2026-20783-intel-npu-driver-improper-conditions-check-in-firmware)
- [Intel NPU Driver improper conditions check denial of service](https://junglewise.ai/threats/cve-2026-20769-intel-npu-driver-improper-conditions-check-denial-of-service)