Intel Open Volume Kernel Library up to 2.0.1 heap-based overflow

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Intel Open Volume Kernel Library up to 2.0.1. This affects an unknown function. This manipulation causes heap-based overflow. This vulnerability is tracked as CVE-2026-21399. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability was found in Intel Open Volume Kernel Library up to 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect integrity, and availability. The summary by CVE is:

Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

It is possible to read the advisory at intel.com. This vulnerability is known as CVE-2026-21399 since 12/19/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/11/2026).

Upgrading to version 2.0.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Intel

Name

• Open Volume Kernel Library

Version

• 2.0.0
• 2.0.1

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion