CVE-2026-21387

Executive Summary

CVE-2026-21387 is a local privilege-escalation vulnerability in the Intel(R) LLM Library for PyTorch, caused by a protection mechanism failure (CWE-693) that manifests within Ring 3 (user applications). An unprivileged software adversary operating in conjunction with a privileged user context can exploit the flaw through low-complexity, local-access techniques that require only passive user interaction, achieving high impact to the confidentiality, integrity, and availability of the affected system. No patch is currently available from Intel, the vulnerability is not listed on the CISA KEV catalog, and no public exploit code has been identified, but the unpatched status combined with high CIA impact warrants immediate detection and hardening measures for any environment running the library.

Technical Analysis

The NVD description for CVE-2026-21387 is sparse and lacks implementation-level detail, so this analysis is necessarily conducted at the vulnerability-class level rather than with function- or code-level specifics.

The root cause is classified as CWE-693 (Protection Mechanism Failure), meaning the software either fails to implement an intended security control, implements it incorrectly, or fails to enforce it under certain conditions. In this case, the failure occurs inside the Intel(R) LLM Library for PyTorch while executing within Ring 3 — the unprivileged, user-mode execution layer of the operating system. Protection mechanism failures in user-mode libraries typically manifest in one of several generic ways:

• Insufficient validation of input supplied by a lower-privileged caller, allowing a boundary to be crossed.
• Incorrect handling of access-control checks (e.g., a capability check skipped under a specific error condition or state).
• Faulty state management that leaves an elevated-privilege handle, token, or execution context accessible to a less-privileged operation.

The adversarial profile described by the vendor is an "unprivileged software adversary with a privileged user combined with a low complexity attack." Interpreted strictly, this indicates the attack is launched by software running without privileges, but succeeds because it is initiated within — or chained through — the context of a user who already holds privileged rights on the endpoint. The requirement for "passive user interaction" implies the victim does not need to perform complex actions; a single action such as opening a crafted file, loading a malicious model artifact, or interacting with content that routes processing through the LLM library would suffice. The attacker does not require special internal knowledge of the system, and no significant preconditions beyond local access and the presence of the vulnerable component are described.

Public advisories do not currently disclose the specific attack surface entry point (e.g., model parsing, tensor manipulation, or an exposed API within the library). From the CWE-693 classification and Ring 3 context, the most plausible mechanism is a missing or bypassable enforcement check in one of the library's processing paths that permits a lower-integrity caller to inherit or reuse an elevated-privilege context. Because the product is a component embedded within a host application, the practical attack surface is any system where a privileged user runs an application that loads the Intel LLM Library for PyTorch.

The described impact is confidentiality high, integrity high, and availability high for the vulnerable system itself, with no downstream (subsequent system) impact. This pattern is consistent with an adversary who achieves full control of the locally hosted environment — reading sensitive data, modifying model weights or application logic, and disrupting availability — but who does not automatically pivot to other networked systems as a result of this specific flaw.

Insufficient technical detail is available to describe function names, specific file paths, or the precise failing check; those details will require the vendor advisory or independent researcher analysis.

Exploitation Scenarios

No public PoC is available, and the attack chain is inferred from the vulnerability class (CWE-693 protection mechanism failure) and the constraints stated in the NVD description. The following scenario reflects the most likely chain consistent with the disclosed data:

1. Reconnaissance / target identification. The attacker first identifies an endpoint where an application uses the Intel(R) LLM Library for PyTorch and where the current user session runs with elevated (privileged) rights. Since the vector is local access, the attacker requires either a foothold on the machine (e.g., malicious software already running unprivileged) or physical/interactive access to a session. The adversary does not need internal knowledge of the system internals, per the description.

2. Triggering the flaw. The attacker crafts an input that is routed through the vulnerable library while a privileged user is passively interacting with it — for example, the victim opens or loads a file, a model, or a document that the LLM library processes. The crafted input is designed to place the library into a state where its protection mechanism (CWE-693) fails to enforce the intended privilege boundary between the unprivileged caller and the privileged user context.

3. Payload / execution method. At the vulnerability-class level, the failing protection check allows the unprivileged software adversary to escalate its execution context to that of the privileged user. Because the attack is low complexity and requires no special internal knowledge, the payload likely leverages standard user-mode techniques: executing a command or loading code within the elevated context, abusing the library's execution flow to run attacker-controlled instructions under the victim's privileges.

4. Post-exploitation impact. Once execution in the privileged context is achieved, the attacker gains high confidentiality, integrity, and availability impact over the affected system: reading protected data accessible to the privileged user, modifying or poisoning application/model behavior, and disrupting the availability of the host application. Per the advisory, there is no stated cascading impact on subsequent systems, so lateral movement is not an automatic consequence of this CVE and would require separate techniques.

Timeline note: this is an unpatched, non-KEV vulnerability with an EPSS score of 0.00154 (5.1% percentile of exploited CVEs), indicating low current exploit probability in the wild. However, the absence of a patch means that window will widen if exploitation techniques are disclosed.

Impact Assessment

Business impact. The vulnerability affects organizations that deploy applications built on the Intel(R) LLM Library for PyTorch — a component typically used to accelerate and serve LLM workloads, including inference pipelines, model-serving containers, and developer workstations. Because the flaw is local and requires a privileged user session plus passive interaction, the realistic risk scenario is a compromised unprivileged process on a machine where an analyst, data scientist, or inference operator holds elevated rights.

Affected systems. Any Windows/Linux endpoint or container image embedding the library, particularly those running with a privileged service account. The "Ring 3: User Applications" designation confirms the flaw resides in the user-mode library, not the kernel, which narrows the blast radius to the host process and the user context it runs under.

Blast radius. The advertised impact is confidentiality high, integrity high, and availability high on the vulnerable system, with no subsequent-system impact. In practice this means full compromise of the local host state accessible to the privileged user, including model weights (integrity), sensitive prompts/output logs (confidentiality), and service uptime (availability). The downstream system impact of "none" limits the immediate lateral blast radius, but a fully compromised endpoint remains a staging point for further attacks using unrelated techniques.

Risk posture. CVSS score is N/A, so risk must be inferred from the narrative: local access, low complexity, passive user interaction, and no special knowledge required are all favorable attacker conditions. The offsetting factors are the requirement for a privileged user present at the session and the current absence of public exploit code and KEV listing. Given the unpatched status (0/4 patch confidence), the residual risk for affected deployments is elevated, particularly in multi-user environments or managed endpoints where unprivileged software co-exists with privileged sessions.

Detection Guidance

The following detection content is heuristic because the vendor has not disclosed the specific failing mechanism, file paths, function names, or exploit indicators for CVE-2026-21387. The rules focus on the observable outcome of the vulnerability class — a process hosting the Intel LLM Library for PyTorch (typically a Python-based inference process) spawning unexpected elevated children, anomalous privilege changes, or unauthorized access to privileged resources. Tune these rules to your environment to reduce false positives.

Sigma Rule

title: Suspicious Child Process from Intel LLM Library for PyTorch Host (CVE-2026-21387)
id: 7f2b9c1e-4a3d-4f6b-9a1c-2d8e5f6a7b3c
status: experimental
description: Detects process creation from a Python/PyTorch host process (per the Intel LLM Library for PyTorch component) spawning an interactive shell or system utility, consistent with privilege escalation via CWE-693 protection mechanism failure.
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pythonw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    IntegrityLevel:
      - 'High'
      - 'System'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative Python automation that intentionally invokes shells
  - Development and data-science workflows on analyst workstations
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-21387

YARA Rule

/*
   Heuristic hunting rule for CVE-2026-21387 (Intel LLM Library for PyTorch,
   CWE-693 protection mechanism failure / local privilege escalation).
   No exploit-specific byte patterns are publicly known; this rule flags
   artifacts that reference the affected component or the CVE identifier,
   and likely advisory / exploit-chatter documents.
*/
rule CVE_2026_21387_Intel_LLM_Library_EoP_Hunt
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Hunt for files or memory images referencing CVE-2026-21387 and the Intel LLM Library for PyTorch"
        cve = "CVE-2026-21387"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-21387"
        severity = "high"

    strings:
        $a1 = "Intel LLM Library for PyTorch" ascii wide nocase
        $a2 = "CVE-2026-21387" ascii wide nocase
        $a3 = "Protection mechanism failure" ascii wide nocase
        $a4 = "Ring 3" ascii wide nocase
        $b1 = "escalation of privilege" ascii wide nocase
        $b2 = "llm" ascii wide nocase
        $b3 = "pytorch" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and              // PE file
        ($a1 or $a2 or $a3 or $a4) and
        (2 of ($b*))
}

Suricata IDS Rule

Network detection is supplementary for this vulnerability because the described attack vector is local access. The following rule alerts on crafted payloads or command-and-control traffic that explicitly references the CVE or the affected component — a common pattern in exploit-drop and weaponized-model delivery.

alert http any any -> any any (msg:"CVE-2026-21387 Intel LLM Library for PyTorch exploit chatter / delivery attempt"; flow:established,to_server; content:"CVE-2026-21387"; http.uri; content:"Intel"; http.uri; classtype:attempted-admin; sid:202621387; rev:1; metadata:created_at 2026-01-01, cve 2026-21387;)

alert http any any -> any any (msg:"CVE-2026-21387 reference to Intel LLM Library for PyTorch in payload"; flow:established,to_client; content:"Intel LLM Library for PyTorch"; http.header; content:"Content-Type"; http.header; classtype:unknown; sid:202621388; rev:1; metadata:cve 2026-21387;)

Analysts should treat these as low-prevalence indicators of exploit-related activity; absence of such traffic does not indicate absence of exploitation, since the primary vector is local.

Elastic Detection

sequence by host.name, user.name with maxspan=30s
  [ process where event.type == "start"
      and process.parent.name in ("python.exe", "python3.exe", "pythonw.exe")
      and process.name in ("cmd.exe", "powershell.exe", "rundll32.exe", "wscript.exe", "cscript.exe") ]
  [ process where event.type == "start"
      and process.Ext.integrity_level in ("High", "System")
      and process.parent.name in ("python.exe", "python3.exe", "pythonw.exe") ]

This EQL sequence detects a Python-hosted LLM-library process spawning a shell or scripting host and then a subsequent elevated process — the observable signature of the privilege-escalation outcome described for CVE-2026-21387. Supplement with Windows Defender / Sysmon process-integrity telemetry where available.

Splunk SPL Query

index=windows source="WinEventLog:Security" EventCode=4688
| where match(New_Process_Name, "(?i)(cmd|powershell|rundll32|wscript|cscript)\.exe")
| rename ParentProcessName AS ParentProcessName
| search ParentProcessName IN ("*.\\python.exe", "*.\\python3.exe", "*.\\pythonw.exe")
| eval integrity = coalesce(IntegrityLevel, "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, ParentProcessName, New_Process_Name, integrity
| where count > 0

For Splunk Enterprise Security or ES, additionally correlate with Authentication / privilege-change logs:

index=windows sourcetype=WinEventLog:Security (EventCode=4672 OR EventCode=4688)
| spath input=Message
| search ParentProcessName="*python*"
| table _time, host, user, ParentProcessName, New_Process_Name, IntegrityLevel

Wazuh OSSEC Rule

<group name="pytorch,cve-2026-21387,privilege_escalation,">

  <!-- Generic Sysmon process-creation parent-child correlation for the CVE-2026-21387 outcome -->
  <rule id="100987" level="12">
    <if_sid>92050</if_sid>
    <field name="win.eventdata.parentImage">\.(python|python3|pythonw)\.exe</field>
    <field name="win.eventdata.image">\.(cmd|powershell|rundll32|wscript|cscript)\.exe</field>
    <description>CVE-2026-21387: Intel LLM Library for PyTorch host process spawned a shell/system utility (possible privilege escalation)</description>
    <group>privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>

  <!-- Alert when the host process runs with High/System integrity and spawns a child process -->
  <rule id="100988" level="14">
    <if_sid>100987</if_sid>
    <field name="win.eventdata.integrityLevel">(High|System)</field>
    <description>CVE-2026-21387: Elevated child process spawned from Python/LLM library host process - high-confidence escalation indicator</description>
    <group>privilege_escalation,</group>
  </rule>

</group>

Note: if_sid>92050 assumes the standard Wazuh Sysmon process-creation decoding rule; adjust the parent rule ID to match your Wazuh/Sysmon integration (e.g., 92050 for Sysmon EventID 1). If Sysmon is not deployed, replace with a Windows EventID 4688-based rule.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor advisory has been published, and no fixed version has been announced. Organizations must assume the current Intel(R) LLM Library for PyTorch is vulnerable until Intel releases remediation.

1. Immediate mitigations (no patch available):

   • Restrict local access to systems running the Intel LLM Library for PyTorch. Apply the principle of least privilege to user accounts; ensure the library and its host application never run under domain-admin, root, or local-administrator-equivalent accounts where a lower-privileged process could co-exist in the session.
   • Isolate LLM inference and model-serving workloads into dedicated, low-privilege service accounts or containers with minimal OS-level permissions.
   • Until patched, refrain from opening untrusted model files, documents, or datasets on privileged workstations, given the passive user interaction requirement.
   • Apply application control (e.g., AppLocker, Windows Defender Application Control, Linux SELinux/AppArmor) to block unexpected child-process creation from Python-based inference hosts.
   • Monitor endpoints for the anomalous process chains covered in the Detection Guidance section above.

2. Patch / upgrade steps:

   • No vendor patch exists. Subscribe to the Intel Security Center advisory feed (https://www.intel.com/content/www/us/en/security-center/default.html) and monitor the NVD entry for CVE-2026-21387 for updates.
   • When Intel releases a fixed version of the LLM Library for PyTorch, validate affected-version guidance from the advisory, test the update in a staging environment, and deploy via your standard change-management process. Until then, do not assume any build is safe.

3. Long-term hardening:

   • Segment LLM workloads from general-purpose user endpoints so that a privileged user session and unprivileged attacker-controlled software cannot converge on the same host.
   • Enforce host-based EDR with behavioral detection on process integrity transitions, since signature-based detection is insufficient for an unknown, unpatched local flaw.
   • Incorporate CVE-2026-21387 into vulnerability-management tracking and re-evaluate when Intel publishes the advisory; the EPSS score (0.00154) is low but will change as technical details and weaponization emerge.
   • Establish a response plan for the "confidentiality, integrity, availability: high" impact profile: assume that if exploited, model weights, training/inference data, and the host OS state are compromised.

References

1. NVD Entry — CVE-2026-21387: https://nvd.nist.gov/vuln/detail/CVE-2026-21387
2. Intel Security Center (advisory portal — no dedicated advisory published yet): https://www.intel.com/content/www/us/en/security-center/default.html
3. CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-21387 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST.org EPSS (score 0.00154, 5.1% percentile): https://www.first.org/epss/

Threat-actor / in-the-wild evidence: None identified. CVE-2026-21387 is not present in the CISA KEV catalog, no public exploit code or Nuclei template exists, and no known threat-actor campaigns reference this CVE at the time of writing. The absence of a patch and the low exploitation probability reflected in EPSS should not be interpreted as low risk for affected organizations; the high CIA impact and low-complexity attack requirements make this a candidate for future weaponization once technical details are disclosed.