CVE-2026-32791: Medium severity Intel Intel(R) Performance Counter Monitor (Intel(R) PCM) vulnerability
Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Intel(R) Performance Counter Monitor (Intel(R) PCM)to a version that resolves this vulnerability.Fixed in 202604 - Compensating control
Apply mitigation for the untrusted search path risk in Ring 3: User Applications by ensuring the process runs with a trusted, fully qualified library/search path (e.g., avoid relative paths / untrusted directories) for Intel(R) Performance Counter Monitor (Intel(R) PCM) prior to version tag 202604.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32791?
CVE-2026-32791 has a risk score of 44, indicating a significant potential for exploitation.
How do I fix CVE-2026-32791?
To mitigate CVE-2026-32791, update to the latest version of Intel(R) Performance Counter Monitor (Intel(R) PCM) released after version tag 202604.
Who is affected by CVE-2026-32791?
Users of Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 are at risk of this vulnerability.
What type of vulnerability is CVE-2026-32791?
CVE-2026-32791 is categorized as an escalation of privilege vulnerability.
Can CVE-2026-32791 be exploited remotely?
CVE-2026-32791 requires an authenticated user to exploit, making remote exploitation less likely.