CVE-2026-42966: Intel Neural Compressor uncaught exception privilege escalation

CVE-2026-42966 · Severity: info · Published 2026-11-10

Intel Neural Compressor is a software tool used to optimize machine learning models. An uncaught exception in versions before 3.8 could allow an authenticated local user to escalate their privileges on the system. An attacker with basic user access could potentially gain elevated privileges without additional interaction.

Technologies: Intel Neural Compressor. Vendors: Intel.

Quick answers

Is CVE-2026-42966 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42966 being exploited in the wild.
How severe is CVE-2026-42966?
Informational severity, published 10 November 2026.
Which products and versions are affected?
Intel Neural Compressor before 3.8.
Is there a fix for CVE-2026-42966?
Yes: fixed in 3.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42966 attacked?
It is attacked with local access.
Am I affected by CVE-2026-42966?
Check whether you run Intel Neural Compressor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.8

Technical details

An uncaught exception in Intel Neural Compressor before version 3.8 allows privilege escalation via local access. An authenticated unprivileged user can trigger the exception with low attack complexity and no user interaction required. The vulnerability impacts system confidentiality, integrity, and availability at low severity levels.

Affected products

  • Intel Neural Compressor before 3.8

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.