CVE-2023-43748 is a high severity (7.8) improper access control flaw in Intel Graphics Performance Analyzers Framework, which can let a local user escalate privileges. Intel fixed it in version 2023.3 under advisory INTEL-SA-00831. Update to 2023.3 or later, starting with shared machines.
What's affected
Intel advisory INTEL-SA-00831 says the affected software is Intel Graphics Performance Analyzers Framework installers before version 2023.3. The fixed version is 2023.3. The NVD record lists one product, Access Flaw in Intel GPA Framework, with no further version detail, and Intel's advisory agrees on the fix.
Intel and NVD both score the flaw 7.8 (High). The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In plain terms the attack is made locally, from code or a user already on the device, attack complexity is low, it needs a low privilege account, and it needs no user interaction. Impact on confidentiality is high, on integrity high and on availability high.
The weakness is tagged CWE-284.
How to check if you're exposed
On a Windows workstation, list installed Intel GPA components and their versions:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Graphics Performance Analyzers*' | Select-Object DisplayName, DisplayVersion
Any version below 2023.3 is in scope. You can also open the GPA tools and check the version in the About dialog. Include build machines and shared developer images, since installers can be run on those as well.
What to do now
- Find every machine with Intel GPA or the GPA Framework installed. Developer laptops and graphics test rigs are the usual places.
- Download version 2023.3 or later from the Intel download page linked in the advisory and install it over the old version.
- Re-run the version check to confirm nothing older is left behind.
- Add GPA to your software inventory so the next Intel advisory is easy to match.
Why it matters
CWE-284 is improper access control. Access to a resource is not restricted the way it should be.
Both Intel GPA entries in advisory INTEL-SA-00831 describe an installer problem. The installer sets up files or permissions in a way that a user who is already logged in can abuse to gain more rights. That makes it a local privilege escalation, not something that is reachable from the internet. The risk grows on shared machines, build servers and lab systems where several people have accounts.
Neither the record nor the Intel advisory says the flaw is exploited in the wild, and the record does not mark it as a CISA Known Exploited Vulnerability.
Quick check
Can this be exploited remotely?
Not by itself. The vector is local and needs a user who already has an account on the machine.
What version fixes it?
Intel lists 2023.3 as the fixed version. Anything older than that needs the update.
Sources
Last reviewed: 19 October 2026.
