CVE-2023-40071 is a High severity (CVSS 7.3) improper access control flaw in some Intel Graphics Performance Analyzers (GPA) installers before version 2023.3. An authenticated local user could escalate privileges. Intel says to update GPA and the GPA Framework to 2023.3 or later.
What's affected
Affected: Intel Graphics Performance Analyzers (GPA) software installers before version 2023.3, and per Intel's advisory INTEL-SA-00831, Intel GPA and Intel GPA Framework software before 2023.3. Fixed: 2023.3 or later.
Intel's advisory rates this CVE 7.3 (High), which matches the NVD record. The advisory covers several CVEs with scores from 6.7 to 8.2, so when you read it, find the row for this CVE.
How to check if you're exposed
On Windows, open Settings, then Apps, and look for Intel Graphics Performance Analyzers or the GPA Framework. Read the version number. You can also query from PowerShell:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like '*Graphics Performance Analyzers*' |
Select-Object DisplayName, DisplayVersion
Any version below 2023.3 is in range. Developer workstations and game studio build machines are the usual places to find it.
What to do now
- Find installs of Intel GPA and the GPA Framework on developer and test machines.
- Update to version 2023.3 or later from Intel's download page for the Graphics Performance Analyzers.
- Remove the tool from machines that no longer need it.
- Limit local accounts on shared build or test systems, since the flaw needs an authenticated local user.
- Note the update in your tool inventory.
Why it matters
The weakness class is CWE-284 (improper access control). The record says improper access control in some GPA installers may allow an authenticated user to potentially enable escalation of privilege through local access. Intel's advisory groups it with other GPA privilege escalation findings.
The attack vector is local and needs a low privilege account, which is why the score stops at 7.3. The risk is highest on shared machines where several people have accounts. NVD published the record on 2024-05-16. The KEV flag is false.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this be exploited remotely?
No. The vector is local and needs an authenticated user on the machine.
What version is safe?
Intel's advisory says 2023.3 or later.
Sources
Last reviewed: 19 October 2026.
