Intel VTune Profiler up to 2025.1 Device Drivers race condition

Summaryinfo

A vulnerability was found in Intel VTune Profiler. It has been classified as very critical. Affected by this vulnerability is an unknown functionality of the component Device Drivers. Performing a manipulation results in race condition. This vulnerability is identified as CVE-2026-34016. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Intel VTune Profiler. It has been classified as very critical. This affects an unknown code block of the component Device Drivers. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

It is possible to read the advisory at intel.com. This vulnerability is uniquely identified as CVE-2026-34016 since 04/02/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/10/2026).

Upgrading to version 2026.0.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Intel

Name

• VTune Profiler

Version

• 72
• 2020
• 2021.1.1
• 2021.3.0
• 2022.2.0
• 2023.0
• 2024.0
• 2024.1
• 2024.2.0
• 2025.0
• 2025.1

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion