Intel Intelligent Storage Acceleration Library out-of-bounds write

Summaryinfo

A vulnerability described as very critical has been identified in Intel Intelligent Storage Acceleration Library. The affected element is an unknown function. The manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2026-44606. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Intel Intelligent Storage Acceleration Library (unknown version). Affected is an unknown code block. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Out-of-bounds write for some Intel(R) Intelligent Storage Acceleration Library within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

The advisory is shared for download at intel.com. This vulnerability is traded as CVE-2026-44606 since 06/04/2026. The exploitability is told to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 11/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Intel

Name

• Intelligent Storage Acceleration Library

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion