CVE-2023-45320 is a medium severity uncontrolled search path flaw in some Intel VTune Profiler software, scored 6.7. A local authenticated user may escalate privileges. Intel fixed it in version 2024.0, so update any older installation. The tool is common on developer machines, so check those first.
What's affected
The NVD record and Intel advisory SA-01034 agree: Intel VTune Profiler software before version 2024.0 is affected, and 2024.0 or later is the fix. The CVSS 3.1 score is 6.7, medium, with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
Read the vector as local access, high attack complexity, low privileges, and a user who has to take part. Those requirements are why the score stays in the medium range despite high impact ratings.
The record lists CWE-427 (uncontrolled search path element) and also CWE-269 (improper privilege management).
How to check if you're exposed
VTune Profiler is a performance analysis tool, usually installed on developer workstations and on lab or build machines used for profiling.
Check the installed version in the product or from the command line of a standard install. The exact path depends on how it was installed, so confirm in the product's About dialog if you are unsure. On Windows you can list the installed program version:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like "*VTune*" | Select DisplayName, DisplayVersion
Any version below 2024.0 is in scope. Also check bundles such as oneAPI toolkits, which can include VTune as a component.
What to do now
- Inventory VTune Profiler installs, including those inside oneAPI toolkit bundles.
- Update to version 2024.0 or later.
- Remove copies on machines that no longer do profiling.
- Review who can write to directories that privileged processes search for libraries on shared machines.
- Record the new version in your tool inventory so the next advisory is easy to match.
Why it matters
An uncontrolled search path means a program looks for a file, usually a library, in a place an unprivileged user can influence. If the program runs with higher rights, it may load the wrong file and run its code. This class of bug, CWE-427, is common in Windows installers and tools.
The fix is usually small, such as loading only from trusted absolute paths, but the exposure is easy to miss because it depends on directory permissions and on how the tool is launched.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation. Developer tools matter because developer machines often hold source code, signing keys and cloud credentials, so a local privilege gain there is worth closing.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
What is the fixed version?
Version 2024.0 or later, per Intel's advisory SA-01034.
Does an attacker need to be on the network?
No. The record describes local access by an authenticated user.
Sources
Last reviewed: 19 October 2026.
