Intel Hyperscan: Heap-based buffer overflow allows denial of service
Summary
Hyperscan before v5.4.2.1 contains a heap-based buffer overflow in Ring 3 user applications. A local, unprivileged attacker can trigger it with low complexity, and it requires passive user interaction. Successful exploitation can crash the affected application and cause a denial of service, while confidentiality is not affected.
Affected
- Intel Hyperscan before v5.4.2.1
Fixed in
- v5.4.2.1 (implied by the affected range and confirmed by third-party mirrors; verify in the Intel advisory)
Workaround
- Unknown. No vendor-stated workaround found.
- General hardening: limit local access to trusted users. This is not an official mitigation.
Exploitation
- Not known to be exploited. No CISA KEV entry found at the time of research.
- No public exploit found. One aggregator reports a public detection template, which is unconfirmed.
Our recommendation
- Identify systems and applications that embed Hyperscan, including products from third-party vendors.
- Update Hyperscan to v5.4.2.1 or later, and update bundled applications once their vendors ship fixes.
- Restrict local user access on shared multi-user hosts.
- Verify the affected and fixed versions in Intel advisory INTEL-SA-01511 and check the NVD record once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01511 intel.com
- Strix CVE-2026-63540 www.strix.ai
- OffSeq Radar: CVE-2026-63540 denial of service in Hyperscan radar.offseq.com
- OffSeq Radar: heap-based buffer overflow in Hyperscan (CVE-2026-63540) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:01.
Original description (NVD)
Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.