CVE-2023-38566 is a medium severity (CVSS 6.7) uncontrolled search path flaw in Intel Implicit SPMD Program Compiler (ISPC) before version 1.21.0. An authenticated local user may be able to escalate privileges. Update ISPC to 1.21.0 or later, including on build servers.
What's affected
The affected product is the Intel Implicit SPMD Program Compiler, known as ISPC, in versions before 1.21.0. The record says uncontrolled search path in some ISPC software may allow an authenticated user to potentially enable escalation of privilege through local access. The record is dated 2024-02-14 and scores 6.7, Medium, with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
The record references Intel advisory INTEL-SA-00994. Intel's site refused my request, so I only had the record. Use the advisory to confirm which builds and platforms are affected and where to download the fixed release.
Weakness class: CWE-427.
How to check if you're exposed
Check the installed ISPC version.
ispc --version
Any version below 1.21.0 is affected per the record. Also check build servers and developer images that bundle a copy of the compiler, since a compiler downloaded as a standalone archive does not update with the system.
What to do now
- Find ISPC installs on developer machines, build agents and container images.
- Update to 1.21.0 or later.
- Rebuild container and build images that include the compiler.
- Review which accounts can write to the directories the compiler loads from.
- Read INTEL-SA-00994 for any extra instructions.
Why it matters
An uncontrolled search path means the program looks for a file or library in a location that a lower privileged user can write to. If the compiler or its installer runs with higher privilege, a planted file in that location is loaded and runs with those rights. The vector shows a high attack complexity and a need for user interaction, so conditions have to line up.
Build agents deserve special care. They often run as a shared service account and hold signing keys or deployment credentials, so a local escalation there reaches further than on a personal laptop. The CVE is not on the CISA Known Exploited Vulnerabilities list.
An uncontrolled search path element means a program looks for a file or library in a place a lower-privileged user can write to. If the program runs with higher privilege, a planted file gets loaded and runs with that privilege. The remedy is to load from absolute, protected paths and to lock down install directories.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the libraries a project declares, and reachability analysis helps show whether a vulnerable library is actually called. Copies bundled inside other products need your own inventory as well.
Quick check
Which version fixes it?
The record says before 1.21.0 is affected, so use 1.21.0 or later.
Why mention build servers?
Shared accounts and stored credentials make local escalation on a build agent more damaging.
Sources
Last reviewed: 19 October 2026.
