CVE-2025-35979 in Processor
Summary
by MITRE • 05/12/2026
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/15/2026
This vulnerability represents a sophisticated microarchitectural information disclosure flaw that exploits shared predictor state within Intel processors operating in VMX non-root (guest) environments. The issue stems from the transient execution behavior of modern processors where shared microarchitectural resources including branch predictors, return address stacks, and instruction fetch mechanisms can retain state information across different execution contexts. When a guest operating system runs within a virtual machine environment on Intel hardware, these shared predictor states can leak information from one execution context to another, creating potential data exposure pathways. The vulnerability specifically affects Intel processors that implement VMX (Virtual Machine eXtensions) technology, where the hypervisor operates in root mode while guest operating systems execute in non-root mode, creating a complex interaction between privileged and unprivileged execution environments.
The technical exploitation of this vulnerability relies on the transient execution characteristics of modern processors where instructions may be speculatively executed and their results cached in microarchitectural structures before the actual execution completes. When multiple execution contexts share these predictor states, information from one context can influence the behavior of another, potentially leaking sensitive data through side-channel mechanisms. Attackers can leverage this by carefully crafting sequences of operations that manipulate the shared predictor state in ways that reveal information from other execution contexts or even from the hypervisor itself. The attack requires an authenticated user with local access to the vulnerable system, but does not necessitate special privileges or user interaction, making it particularly concerning for environments where multiple users share the same physical hardware. This vulnerability aligns with CWE-200 (Information Exposure) and represents a variant of the broader class of transient execution vulnerabilities that have affected various processor architectures.
The operational impact of this vulnerability is significant, particularly for systems running virtualized environments where multiple tenants share the same physical hardware infrastructure. Confidentiality is severely impacted as the vulnerability can potentially expose sensitive information including cryptographic keys, passwords, and other confidential data from different execution contexts or even from the hypervisor layer itself. The vulnerability does not directly affect system integrity or availability, but the potential for unauthorized information disclosure creates cascading security implications that can compromise the overall security posture of affected systems. Organizations running virtualized environments, cloud infrastructure, or multi-tenant systems are particularly vulnerable since these environments naturally create the conditions necessary for the shared predictor state exploitation. The high complexity attack requirements and need for local access limit the attack surface somewhat, but the potential for data exposure remains substantial when attack conditions are met.
Mitigation strategies for this vulnerability include implementing microcode updates from Intel that address the specific transient execution behavior and predictor state sharing issues. System administrators should ensure that all affected Intel processors receive the latest microcode patches and firmware updates. Additionally, virtualization administrators should consider implementing additional isolation mechanisms such as disabling or restricting access to certain processor features that contribute to the vulnerability. The use of hypervisor-level protections and memory isolation techniques can help reduce the impact of shared microarchitectural state. Organizations should also implement monitoring solutions to detect potential exploitation attempts and regularly review system configurations to ensure that virtualized environments are properly isolated. From an ATT&CK perspective, this vulnerability maps to techniques involving information gathering and privilege escalation through side-channel attacks, and should be considered when developing security controls for virtualized environments. The vulnerability highlights the importance of considering microarchitectural security implications in modern processor designs and the need for comprehensive security testing that accounts for shared resource behaviors in complex execution environments.