Intel Core Ultra Hardware Vulnerability Disclosure: Info Leak via Branch Predictor and Bus Ordering (CVE-2025-24495/26012)

Key Information Intel ID: INTEL-SA-01322 Advisory Category: Hardware Vulnerability Impact: Information Disclosure Severity Rating: Medium Original Release Date: May 12, 2025 Last Revised Date: May 12, 2025 Vulnerability Details CVE ID: CVE-2025-24495, CVE-2025-26012 Description: - CVE-2025-24495: Incorrect resource initialization in the branch prediction unit of Intel® Core™ Ultra processors may allow an authenticated user with local access to potentially enable information disclosure. - CVE-2025-26012: Incorrect execution ordering in Intel® Core™ Ultra processors may allow an unauthenticated user with physical access to potentially enable information disclosure. Affected Products Recommendations Intel recommends that users of Intel® Core™ Ultra processors update to the latest versions provided by their system manufacturers to address these issues. Acknowledgments This issue was internally discovered by Intel employees (CVE-2025-26012). Intel thanks Yaniv Shnur and Yoav Moratt. Intel also thanks Sander Wieringa and Cristiano Giuffrida from the VUSec group at VU Amsterdam for reporting this issue (CVE-2025-24495).

Goal Reached Thanks to every supporter — we hit 100%!

Intel Core Ultra Hardware Vulnerability Disclosure: Info Leak via Branch Predictor and Bus Ordering (CVE-2025-24495/26012)