CVE-2026-28757

The CVSS vector for this vulnerability contains a logical impossibility that should make you treat it as unprocessable until clarified. It claims 'high' confidentiality, integrity, and availability impact at the component level while simultaneously asserting 'none' system-level impact. This is not a scoring inconsistency—it is a substantive claim about scope that demands explanation. The Workload Services Framework is a Ring 3 software layer, meaning any exploitation requires an already-unprivileged context. The escalation path goes from unprivileged to what privilege level? The description says 'escalation of privilege' without specifying whether this means sandboxed app to standard user, standard user to admin, or something else entirely. This ambiguity is dangerous because different escalation targets warrant completely different remediation urgency. The 'passive user interaction' requirement combined with 'local access' suggests an attack chain where an adversary needs a logged-in user to do something—but the description does not specify what. This sounds like a DLL hijacking or component-loading attack that may require only that certain software coexist with the framework, not active user participation. If so, the 'escalation' might trigger automatically during routine operation rather than requiring explicit user action. The 'none' system impact claim deserves particular scrutiny. Either the Workload Services Framework is genuinely architecturally isolated such that its compromise affects nothing else—which would be remarkable for a privilege-escalation flaw—or the description reflects a deliberate scope limitation to minimize disclosure obligations. Historical patterns with similar Intel components (Management Engine, SGX) suggest the latter is more likely. Operational guidance: treat the MEDIUM CVSS 5.4 rating as unreliable. The 'high' component impact means the exploitability floor is non-trivial regardless of isolation claims. Request clarification from Intel on what privilege level the escalation actually achieves, what the passive interaction requires, and what mechanism enforces system-level isolation. Consider this component untrusted until proven otherwise—if it's legacy or minimally-maintained infrastructure, isolation assumptions may have rotted. Do not base prioritization on a vector that contains a logical contradiction.

Reviewed through automated stages and approved by a human before publication.