Recovery by the user · R:U
Service recovery requires manual intervention by the user.
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:U
Educational research demonstration
What CVSS v4 Recovery does—and does not—represent
A synthetic comparison holds the score at 8.7 while Recovery changes from R:U to R:I. The number stays the same; the full vector preserves the difference.
Synthetic representation example
One score. Two Recovery values.
Every Base metric is held constant. Only the standard Supplemental Recovery metric changes. This is not an assessment of PMFault or any named vulnerability.
Irrecoverable by the user · R:I
System services are irrecoverable by the user.
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:I
Same number, different vector. Recovery is Supplemental, so this change does not alter the numerical score. The full vector retains the distinction that a score-only view hides.
FIRST · CVSS v4.0 specification ↗
FIRST · published examples ↗
Semantics and evidence
Recovery and Response Effort do not establish physical material damage.
Two different CVSS concepts
Recovery: R:U means user intervention is required; R:I means system services are irrecoverable by the user. Neither value identifies the failure mechanism. Recovery is not a material-damage mechanism field.
Response Effort: RE describes the quickest available initial response to the vulnerability for deployed products and services. It is not post-attack service recovery. Even if a response involves hardware replacement, that effort alone does not show that exploitation physically damaged a component.
FIRST · consumer implementation guide ↗What the cited PMFault paper reports
The primary PMFault paper reports experiments that permanently damaged the studied Intel Xeon CPUs under its experimental conditions.
Scope: the claim is limited to those studied CPUs and conditions. No CVSS score for PMFault is assigned here.
PMFault · TCHES 2023 primary paper ↗Illustrative routing design
Keep source evidence beside the score; do not create another score.
A separate material_damage_evidence field could preserve cited physical-consequence context beside the full vector when it changes human routing. This is an illustrative routing design suggestion.
{
"cvss": {
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:I",
"score": 8.7
},
"material_damage_evidence": {
"status": "DEMONSTRATED",
"source": "PMFault · DOI 10.46586/tches.v2023.i2.1-23",
"scope": "The paper reports permanent damage to the studied CPUs under its experimental conditions."
},
"new_severity_score": null
}Educational design illustration only. material_damage_evidence is not a CVSS extension, is not standardized or shown to be uniquely minimal, and is not a detector or proven product benefit. No new severity score is created. The score belongs to the synthetic comparison; the cited source is separate evidence context.
Reproducibility & limits · fixed two-day NVD observation
One dated view of a fixed publication window.
This is the NVD CVE API 2.0 response as observed during one independent review refresh—not a live lookup performed by this page.
The fixed publication window ran from 2026-09-19 00:00:00 UTC through 2026-09-20 23:59:59 UTC. The refreshed responses returned 210 of 210 CVEs. Ninety-seven assessments included a CVSS v4 vector; all 97 explicitly encoded Recovery as R:X. None used R:A, R:U or R:I in this slice.
- startIndex 0: 200 records; 615,515 UTF-8 bytes; API timestamp 2026-09-21T04:33:29.125; fresh-response SHA-256 b2eb3d1b4a27cec509d8d5c194a78be07bb0241bd4356b40e605920acb507ad9.
- startIndex 200: 10 records; 41,429 UTF-8 bytes; API timestamp 2026-09-21T04:33:38.41; fresh-response SHA-256 7187223d60f4daa3523e51c942ff00845a1db5b1b322891b18e0feab6d39ac93.
This reflects NVD’s current rendering of one fixed two-day publication window; records can later change. It is not a frozen or reconstructed historical dataset, and it is not a prevalence estimate for all CVEs or time periods. The original raw response bytes were not retained. These fresh hashes identify only the review refresh; they cannot reconstruct or authenticate the earlier bytes.
NVD · CVE API 2.0 documentation ↗CVSS is owned by FIRST.Org, Inc. and used with permission.
← Back to Research