CVE-2023-38561 is a medium severity (CVSS 5.5) improper access control flaw in some Intel Extreme Tuning Utility (XTU) software before version 7.12.0.29. An authenticated local user may be able to escalate privileges. Update XTU to 7.12.0.29 or later on every machine.
What's affected
The affected product is Intel Extreme Tuning Utility, known as XTU, in versions before 7.12.0.29. The record says improper access control in some XTU software may allow an authenticated user to potentially enable escalation of privilege through local access. The record is dated 2024-02-14 and scores 5.5, Medium, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the stated impact is on integrity.
The record references Intel advisory INTEL-SA-00955. Intel's site blocked my request, so I read only the record. Use the advisory to confirm the affected builds and the download link for the update.
Weakness class: CWE-284.
How to check if you're exposed
On Windows, open Intel Extreme Tuning Utility and read the version from the About or Help menu. You can also check from PowerShell.
Get-Package -Name "*Extreme Tuning*" | Select Name, Version
Any version below 7.12.0.29 is affected per the record. Tuning tools are often installed by individuals, so check developer and gaming workstations, which may sit outside your usual software inventory.
What to do now
- Find machines that run Intel XTU, including personal tuning installs.
- Update to 7.12.0.29 or later from Intel.
- Remove XTU from systems that do not need overclocking or tuning.
- Read INTEL-SA-00955 for the full details.
- Add the software to your inventory so future updates are tracked.
Why it matters
Tuning utilities talk to low level hardware, so they often run services with high privilege. When a service accepts requests from ordinary users without checking permissions carefully, a user can ask it to do something they should not. The weakness is improper access control, and the stated outcome is a change in integrity.
The score is Medium because the attacker must already be logged in locally. That still matters for shared and managed machines. A normal user who can escalate can disable security tools or reach other users' data. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Improper access control is a broad class. It covers any case where the product does not correctly restrict who can perform an action or read a resource. The remedy is the same each time: decide the permission each action needs, enforce it on the server for every request, and test that lower roles are refused.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which version fixes it?
The record says before 7.12.0.29 is affected, so update to 7.12.0.29 or later.
Do I need XTU?
Many machines do not. Removing unneeded software removes the exposure.
Sources
Last reviewed: 19 October 2026.
