CVE-2023-46691 is a high severity (CVSS 7.9) use-after-free flaw in Intel Power Gadget for Windows that may allow an authenticated local user to escalate privileges. Intel says it is not releasing a fix, because the product is discontinued, and recommends uninstalling it. Remove every installed copy.
What's affected
The NVD record says all versions of Intel Power Gadget for Windows are affected. Intel advisory INTEL-SA-01037 says versions before 3.6.0 are affected and that no update will be released because of the Product Discontinuation Notice. As with the macOS flaw, the sources differ slightly on versions, so treat all installs as exposed.
Intel scores it 7.9 High, matching the record, with a vector that needs a user interaction and changes scope. The weakness is CWE-416. The companion flaw for macOS is CVE-2023-46689.
The NVD record scores it 7.9 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H. The weakness class is CWE-416 (use after free). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open Settings, Apps and search for Intel Power Gadget, or run a query in your endpoint management tool for the application name. The tool also installs a driver, so check your device driver inventory if you use one.
Focus on engineering workstations and laptops used for performance testing.
What to do now
- Search all Windows endpoints for Intel Power Gadget.
- Uninstall it, as Intel recommends.
- Check for leftover drivers and remove them with the uninstall.
- Remove the installer from software catalogues and images.
- Update your asset records.
Why it matters
A use-after-free bug reuses memory after it was released, which can let a local user steer what a privileged component does next. Drivers are a sensitive place for this, because they run with high privileges.
Intel cannot ship a fix, so the only action left is removal. Check the Windows driver list as well, because the tool installs a kernel driver that can outlive a careless uninstall. A local exploit is not rated as critical, but it is a useful step for malware that has already landed.
Quick check
Is there an update?
No. Intel says the product is discontinued and recommends uninstalling it.
Does it need physical access?
It needs local access and an authenticated user, per the vector.
Sources
Last reviewed: 19 October 2026.
