6.8

CVE-2025-35979: intel-microcode

CVSS: 6.8v4.0MediumAwaiting analysis
AliasesALPINE-CVE-2025-35979MGASA-2026-0161SUSE-SU-2026:2963-1
Published 12-05-2026Last modified 12-05-2026
Open JSON

Vulnerability summary

CVE-2025-35979 is a medium (CVSS 6.8) vulnerability in intel-microcode. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.6% of scored vulnerabilities.

Overall risk
27/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.8/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.10%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2026:21736-1SUSE-SU-2026:23459-1SUSE-SU-2026:23602-1

Timeline

  1. 12-05-2026
    PublishedVulnerability first disclosed.
  2. 12-05-2026
    Last modifiedVulnerability information updated.

Description

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.10%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

0.00 pp

From 0.10% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse17 products
  • microcode_ctl&distro=SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE< 1.17-102.83.95.1
  • ucode-intel&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 20260512-150200.65.1
  • ucode-intel&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 20260512-150200.65.1
  • ucode-intel&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 20260512-150200.65.1
  • ucode-intel&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 20260512-150200.65.1
Alpine1 product
  • intel-ucode< 20260512-r0
Debian1 product
  • intel-microcodeAll versions (No fix recorded)
Mageia1 product
  • microcode< 0.20260512-1.mga9.nonfree
Opensuse1 product
  • ucode-intel&distro=openSUSE Tumbleweed< 20260512-1.1
Ubuntu1 product
  • intel-microcodeAll versions (No fix recorded)

6 vendors · 22 products

References

14 links
Show all 14 references