CVE-2023-38541 is a medium severity (CVSS 6.7) insecure inherited permissions flaw in some Intel HID Event Filter driver installers for Windows 10 on Intel NUC laptops, before version 2.2.2.1. An authenticated local user may escalate privileges. Install version 2.2.2.1 or later.
What's affected
The affected product is the Intel HID Event Filter driver for Windows 10, in some software installers for Intel NUC laptops, in versions before 2.2.2.1. The record says insecure inherited permissions may allow an authenticated user to potentially enable escalation of privilege through local access. The record is dated 2024-01-19 and scores 6.7, Medium, with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
The record references Intel security advisory INTEL-SA-00964. Intel's site refused my request, so I could not read it. The version 2.2.2.1 comes from the record's description. Check the advisory for the full list of affected installers and for the download location of the update.
Weakness class: CWE-277, CWE-732.
How to check if you're exposed
On a Windows machine, open Settings, then Apps, and look for Intel HID Event Filter and read its version. In PowerShell:
Get-Package -Name "*HID Event Filter*" | Select Name, Version
If nothing appears, check the list in Programs and Features. A version below 2.2.2.1 is affected, per the record. Remember that the NUC laptop must be Windows 10 with the driver installed from the Intel installer.
What to do now
- List Intel NUC laptops in your fleet that run Windows 10.
- Check the version of Intel HID Event Filter on each one.
- Install version 2.2.2.1 or later from Intel or your device vendor.
- Read INTEL-SA-00964 for the complete list of affected installers.
- Remove the software on machines that do not use the hardware function it supports.
Why it matters
Windows installers create folders and files with permissions inherited from their parent. If the inherited permissions let a standard user change a file that a privileged service loads, that user can have their own code run with higher rights. The advisory language is cautious, which is why the vector has high attack complexity and requires user interaction.
Local privilege escalation flaws are used after an attacker already has a foothold, so they matter for what an intrusion can reach. They are fixed through driver updates, which fleets often miss. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation.
Insecure inherited permissions means a file or folder takes on permissions from its parent in a way that gives more people access than intended. On Windows installers this can let a standard user modify a file that a privileged service later loads.
Incorrect permission assignment for a critical resource means a file, folder or setting is readable or writable by users who should not have that access. When a privileged process uses such a resource, tampering with it can become privilege escalation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which version fixes it?
The record says installers before 2.2.2.1 are affected, so 2.2.2.1 or later.
Does this need remote access?
No. The vector is local, and the attacker must already hold an authenticated account on the machine.
Sources
Last reviewed: 19 October 2026.
