CVE-2023-41961 is a medium severity (CVSS 6.7) flaw in Intel Graphics Performance Analyzers (GPA). An uncontrolled search path in versions before 2023.3 may let an authenticated local user escalate privileges. Update to GPA 2023.3 or later and check Intel advisory INTEL-SA-00831 for the full detail.
What's affected
Intel Graphics Performance Analyzers (GPA) before version 2023.3 is affected, according to the NVD record. Version 2023.3 is therefore the first release outside the range.
The linked Intel advisory (INTEL-SA-00831) is the primary source. Intel's site blocked our automated request, so this post relies on the record alone for versions.
The record scores the flaw 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. It can be reached with local access to the machine, the attack complexity is high, it requires low privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-427 (uncontrolled search path element). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
GPA is a developer tool installed on workstations, so look at developer machines and build hosts that have the graphics analysis tools. Open the tool and read its version, or check the installed programs list. Anything before 2023.3 needs an update.
Also list who can sign in to those machines. The weakness needs a local, authenticated user, so shared lab machines and build agents with many users deserve the first look.
What to do now
- Find every workstation and build host with Intel GPA installed.
- Upgrade to GPA 2023.3 or later.
- Read Intel advisory INTEL-SA-00831 for any further guidance.
- Limit local sign in on shared machines that run developer tools.
Why it matters
The weakness is CWE-427, an uncontrolled search path element. When a program looks for a library or executable in a place a lower privileged user can write to, it may load the wrong file and run it with the program's own rights. That is how a normal user can end up with more access than intended.
Developer tools are easy to forget in a patch program because they sit outside the usual server inventory. A dependency and tool inventory helps you find them before an attacker does.
Quick check
Does this need network access?
No. The vector is local and needs a user to take part, so it is a post foothold risk rather than a remote entry point.
Is it known to be exploited?
The record does not flag it as a CISA KEV entry and we found no statement that it is exploited in the wild.
Sources
- Intel advisory INTEL-SA-00831 (linked from the NVD record; access was refused when we reviewed it)
- CVE-2023-41961 on Gold
Last reviewed: 19 October 2026.
