CVE-2023-40156 is a medium severity (CVSS 6.7) local privilege escalation flaw in Intel System Support Utility (SSU) for Windows before version 3.0.0.2. It needs an authenticated local user and a high complexity setup. Update to 3.0.0.2 or later, as listed in Intel advisory INTEL-SA-01011.
What's affected
The record names Intel System Support Utility (SSU) for Windows, with every release before 3.0.0.2 affected. It scores the flaw 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. That means local access, low privileges, high attack complexity, and a user action, with high impact on confidentiality, integrity and availability if it works.
The weakness class is CWE-427 (uncontrolled search path element). The fixed version in the record is 3.0.0.2, and Intel's advisory INTEL-SA-01011 is the vendor document for it.
One limit on this write-up: Intel's site refused our automated fetch of the advisory, so the versions here come from the NVD record. Read INTEL-SA-01011 before you close the ticket. The record's CPE shows the Windows version of the utility.
How to check if you're exposed
This is a desktop application, so check it on endpoints rather than in code repositories. On Windows, list the installed version with PowerShell and compare it with 3.0.0.2.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*Intel(R) System Support Utility*" |
Select-Object DisplayName, DisplayVersion
You can also open Settings, then Apps, then Installed apps, and search for the product name. If you use an endpoint management tool, query its software inventory for the same name and sort by version. Ask whether the tool still has a job on each machine you find.
What to do now
- Find every machine with Intel System Support Utility (SSU) for Windows installed, using your endpoint inventory or the PowerShell query above.
- Update to 3.0.0.2 or later from the vendor or the OEM support page for the machine.
- If the software is not needed, uninstall it.
- Review who has local logon rights on the affected machines, since the attack needs an authenticated local account.
- Record the advisory number INTEL-SA-01011 in your exception log if a machine cannot be updated yet.
Why it matters
An uncontrolled search path means the program looks for a file, often a DLL or an executable, in a place that an ordinary user can write to, and loads whatever it finds first. If the program runs with higher rights than the user who dropped the file, the user's code runs with those higher rights.
The record says an authenticated user may potentially enable escalation of privilege via local access. The class is CWE-427, and the rating reflects high attack complexity and a required user action. The CPE in the record lists the Windows build of the utility.
Quick check
Can someone exploit CVE-2023-40156 from the network?
Not according to the record. The vector is local (AV:L), so the attacker needs to be logged on to the machine already and the flaw is rated as hard to trigger.
Why would a medium score still be worth fixing?
Privilege escalation bugs are a second step. They turn a low privilege foothold, such as a phished user account, into administrator rights. On shared or kiosk machines that step is easier than it sounds, so a quick update is cheap insurance.
Sources
Last reviewed: 19 October 2026.
