CVE-2023-40154 is a medium severity (CVSS 6.7) local privilege escalation flaw in Intel SUR for Gameplay Software before version 2.0.1901. It needs an authenticated local user and a high complexity setup. Update to 2.0.1901 or later, as listed in Intel advisory INTEL-SA-01004.
What's affected
The record names Intel SUR for Gameplay Software, with every release before 2.0.1901 affected. It scores the flaw 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. That means local access, low privileges, high attack complexity, and a user action, with high impact on confidentiality, integrity and availability if it works.
The weakness class is CWE-276 (incorrect default permissions). The fixed version in the record is 2.0.1901, and Intel's advisory INTEL-SA-01004 is the vendor document for it.
One limit on this write-up: Intel's site refused our automated fetch of the advisory, so the versions here come from the NVD record. Read INTEL-SA-01004 before you close the ticket.
How to check if you're exposed
This is a desktop application, so check it on endpoints rather than in code repositories. On Windows, list the installed version with PowerShell and compare it with 2.0.1901.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*System Usage Report*" |
Select-Object DisplayName, DisplayVersion
You can also open Settings, then Apps, then Installed apps, and search for the product name. If you use an endpoint management tool, query its software inventory for the same name and sort by version. The product is named System Usage Report in the record's product string, and Intel SUR for Gameplay Software in the description.
What to do now
- Find every machine with Intel SUR for Gameplay Software installed, using your endpoint inventory or the PowerShell query above.
- Update to 2.0.1901 or later from the vendor or the OEM support page for the machine.
- If the software is not needed, uninstall it.
- Review who has local logon rights on the affected machines, since the attack needs an authenticated local account.
- Record the advisory number INTEL-SA-01004 in your exception log if a machine cannot be updated yet.
Why it matters
Incorrect default permissions mean the installer or the running service leaves files or folders writable by users who should not be able to change them. If a privileged process later loads or runs something from that location, a low privileged user can plant their own content and gain the rights of that process.
The record's wording is that a privileged user may potentially enable escalation of privilege through local access. The record does not describe the files involved, so we will not guess at them. The class, CWE-276, is a configuration weakness rather than a memory bug, which also means a fix is usually a changed installer or permission set, not a code rewrite.
Quick check
Can someone exploit CVE-2023-40154 from the network?
Not according to the record. The vector is local (AV:L), so the attacker needs to be logged on to the machine already and the flaw is rated as hard to trigger.
Why would a medium score still be worth fixing?
Privilege escalation bugs are a second step. They turn a low privilege foothold, such as a phished user account, into administrator rights. On shared or kiosk machines that step is easier than it sounds, so a quick update is cheap insurance.
Sources
Last reviewed: 19 October 2026.
