CVE-2023-35769 is a medium severity (6.7) uncontrolled search path flaw in Intel Computing Improvement Program (CIP) software before version 2.4.10577. An authenticated local user could use it to escalate privileges. Updating to 2.4.10577 or later closes it, and Intel's advisory INTEL-SA-00959 covers it.
What's affected
The record says Intel CIP software before version 2.4.10577 is affected. Version 2.4.10577 is the first release that is not, so any install older than that needs the update.
The attack needs local access and a login, so this is not a remote risk. It matters most on shared machines such as lab computers, jump hosts and developer workstations where several people have accounts.
I could not open Intel's advisory page from an automated fetch, because it returned an access denied response. The version above comes from the NVD record, which cites advisory INTEL-SA-00959. Read the advisory itself before you close the ticket, in case it lists other products or a different remediation path.
How to check if you're exposed
Intel CIP is a Windows program, so check it from the Windows installed apps list.
- Open Settings, then Apps, then Installed apps.
- Search for Intel Computing Improvement Program.
- Read the version number. Anything below 2.4.10577 is affected.
On a fleet, use whatever software inventory you already run, such as an endpoint management tool, and filter on the product name and version. Machines that never had CIP installed are not affected.
Note that some people uninstall the program and consider the matter closed. That is fine as a fix, as long as no other Intel software on the machine still ships the old component.
What to do now
- Inventory machines that have Intel Computing Improvement Program installed and record the version.
- Update to 2.4.10577 or later using Intel's download or your software distribution tool.
- If nobody needs the program, uninstall it. Removing unused software removes its flaws too.
- Confirm the version after the update on a sample of machines, not just in the deployment report.
- Review who has local accounts on shared machines, and remove accounts that are no longer needed.
- Read INTEL-SA-00959 to confirm nothing else in your estate is listed alongside CIP.
Why it matters
The weakness is CWE-427, uncontrolled search path element. A program that looks for files, often DLLs, in locations a lower privileged user can write to may load something planted there instead of the file it meant to load. If the program runs with more privileges than the user, the planted file runs with those privileges.
The record scores it 6.7. The vector requires local access, high attack complexity, a low privilege account and some user interaction, which keeps the number out of the high range. It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation in the sources I could read.
Bugs like this are a good reminder that privilege escalation flaws still matter after an initial foothold. An attacker who has a basic account on a machine, through phishing or a stolen credential, looks for exactly this kind of step up.
Quick check
Can this be exploited over the network?
The record describes a local attack. An attacker needs an authenticated account on the machine first.
What is the first safe version?
The record says versions before 2.4.10577 are affected, so 2.4.10577 or later. Confirm with Intel's advisory INTEL-SA-00959.
Sources
- Intel advisory INTEL-SA-00959 (cited by the record; blocked to automated fetch)
- Safeguard Gold entry for CVE-2023-35769
Last reviewed: 19 October 2026.
