CVE-2023-36493 is a medium severity (6.7) uncontrolled search path flaw in some Intel SDK for OpenCL Applications software. An authenticated local user could escalate privileges. The record gives no version, so Intel's advisory INTEL-SA-00992 is the place to confirm the fixed release.
What's affected
The NVD record says "some Intel SDK for OpenCL Applications software" is affected. It does not list version numbers, and it does not say which release fixes the problem.
I tried to read Intel's advisory, INTEL-SA-00992, which the record cites, but the page refused an automated request. So I cannot confirm a fixed version here. Do not guess one. Open the advisory in a browser and read the affected and fixed versions table.
This matters on developer workstations and build machines, which is where OpenCL development tools tend to live. The attack is local and needs a login, so shared build servers and lab machines deserve the first look.
How to check if you're exposed
Start by finding out whether the SDK is installed at all.
- Open Settings, then Apps, then Installed apps on Windows machines used for graphics or compute development.
- Search for Intel SDK for OpenCL Applications.
- Note the version, then compare it with the table in INTEL-SA-00992.
If you run build images or developer VMs from a template, check the template as well as running machines, since the old SDK can reappear every time a new machine is created from it.
If you do not find the SDK, nothing more is needed for this CVE.
What to do now
- Find every machine with the Intel SDK for OpenCL Applications installed.
- Open INTEL-SA-00992 in a browser and read which versions are affected and which release fixes them.
- Update to the fixed release, or uninstall the SDK if no one uses it.
- Fix the machine images and build templates so new machines do not bring the old version back.
- Limit local accounts on shared development machines to people who need them.
- Record the version you landed on in your asset inventory.
Why it matters
The weakness is CWE-427, uncontrolled search path element. The software searches for code in a location that a lower privileged account can influence, and may run the wrong file. Because the vulnerable software runs with higher rights than the user, that can turn a normal account into a more powerful one.
The record scores it 6.7 with a local vector, high complexity, low privileges and some user interaction. That fits a bug that is real but needs a foothold first. It is not in CISA's Known Exploited Vulnerabilities catalogue, and I found no claim of exploitation.
Developer tooling is an easy blind spot. It is installed once, rarely updated and often runs on machines that also hold source code and credentials. A local privilege bug on such a machine is worth fixing even at a medium score.
Quick check
Is a fixed version confirmed in the record?
No. The record names no versions. Read Intel's advisory INTEL-SA-00992 for the affected and fixed versions.
Does this need network access?
No. The record describes a local attack by an authenticated user.
Sources
- Intel advisory INTEL-SA-00992 (cited by the record; blocked to automated fetch)
- Safeguard Gold entry for CVE-2023-36493
Last reviewed: 19 October 2026.
