Home » Database

AVID-2026-R1426

Description

Vulnerability CVE-2024-22476

Details

Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.

Reason for inclusion in AVID: CVE-2024-22476 describes improper input validation in Intel Neural Compressor software, enabling unauthenticated remote privilege escalation. Neural Compressor is a software component commonly used in AI model optimization pipelines, i.e., part of the software stack for building/deploying AI systems. This is a software supply-chain/installation-time vulnerability with clear security impact (privilege escalation via network). Therefore it is AI-related, affects a GPAI tech stack, is a security vulnerability, and has sufficient evidence in the report.

References

Affected or Relevant Artifacts

  • Developer: n/a
  • Deployer: n/a
  • Artifact Details:
TypeName
SystemIntel(R) Neural Compressor software

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score10.0
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-20Improper input validation

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-05-16
  • Version: 0.3.3
  • AVID Entry