CVE-2026-32791: Intel PCM Privilege Escalation Vulnerability

CVE-2026-32791 Overview

CVE-2026-32791 is an untrusted search path vulnerability [CWE-426] affecting Intel Performance Counter Monitor (Intel PCM) before version tag 202604. The flaw resides in Ring 3 user applications and can allow an authenticated local user to escalate privileges. Exploitation requires passive user interaction and a high-complexity attack sequence. Successful abuse compromises the confidentiality, integrity, and availability of the vulnerable system. Intel published details in Security Advisory SA-01488.

Critical Impact
A local, authenticated attacker can hijack the DLL or library search path used by Intel PCM to load attacker-controlled code with elevated privileges, resulting in high-impact loss of confidentiality, integrity, and availability on the affected host.

Affected Products

Intel Performance Counter Monitor (Intel PCM) versions prior to tag 202604
Ring 3 user application components of Intel PCM
Systems where Intel PCM binaries are installed in user-writable or search-path-influenced directories

Discovery Timeline

2026-08-11 - CVE-2026-32791 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-32791

Vulnerability Analysis

CVE-2026-32791 is an untrusted search path vulnerability in Intel PCM, a toolkit that exposes performance counter telemetry from Intel processors. When PCM binaries execute, they resolve dependent libraries or auxiliary components using a search path that includes locations an unprivileged user can influence. An attacker who can place a malicious library or executable in one of those locations causes PCM to load attacker-controlled code within the security context of the calling process.

Because PCM is commonly launched by administrators or scheduled with elevated rights to access hardware performance counters, hijacking its load path produces a direct privilege escalation. The attack requires an authenticated local user and passive interaction from a targeted user, which raises complexity but does not remove the risk in shared workstations, developer systems, and lab environments.

Root Cause

The root cause is improper control of the library and binary search path used by Intel PCM before build tag 202604. The application does not restrict lookup to trusted, absolute paths, so components resolved at runtime can be satisfied from directories writable by non-privileged users. This matches the CWE-426: Untrusted Search Path weakness pattern.

Attack Vector

Exploitation is local. An authenticated attacker stages a malicious dynamic library, helper binary, or dependency in a directory that appears earlier in the resolution order than the legitimate component. When a privileged user subsequently launches Intel PCM, the loader binds to the attacker-controlled artifact. The malicious module then executes with the privileges of the PCM process, granting the attacker elevated code execution.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Intel Security Advisory SA-01488 for vendor guidance and version identifiers.

Detection Methods for CVE-2026-32791

Indicators of Compromise

Unexpected DLL, .so, or executable files appearing alongside Intel PCM binaries or in directories referenced by PATH, LD_LIBRARY_PATH, or the current working directory of PCM invocations.
Intel PCM processes (pcm.exe, pcm-memory, pcm-sensor-server, and related utilities) loading modules from user profile or temporary directories.
Child processes spawned by Intel PCM binaries that do not match expected telemetry workflows.

Detection Strategies

Hunt for image loads by Intel PCM processes originating from non-standard paths using endpoint telemetry.
Baseline the legitimate module load set for PCM binaries and alert on deviations, especially unsigned or user-writable libraries.
Correlate PCM execution events with recent file writes to directories included in the process search path.

Monitoring Recommendations

Enable command-line and module-load auditing on hosts running Intel PCM, including developer laptops and performance labs.
Monitor filesystem ACLs on directories that host PCM binaries to detect weakening of permissions.
Forward process, image-load, and file-write events to a centralized analytics platform for retrospective hunting after patch deployment.

How to Mitigate CVE-2026-32791

Immediate Actions Required

Upgrade Intel Performance Counter Monitor to version tag 202604 or later as specified in Intel Security Advisory SA-01488.
Inventory all hosts and container images that include Intel PCM utilities and prioritize systems where PCM is invoked by privileged users.
Restrict execution of Intel PCM binaries to administrators until patching is complete.

Patch Information

Intel resolved CVE-2026-32791 in Intel PCM version tag 202604. Rebuild or redeploy any dependent tooling, container images, and monitoring agents that bundle PCM to pick up the fixed version. Refer to the vendor advisory for the authoritative fixed build identifier and download references.

Workarounds

Install Intel PCM binaries into directories writable only by administrators and remove write permissions for standard users.
Invoke PCM utilities using fully qualified absolute paths and sanitize PATH and LD_LIBRARY_PATH in the launching shell or service definition.
Remove PCM from shared or multi-user systems where privileged users execute the tool alongside unprivileged accounts until the update is applied.

bash

# Configuration example: harden Intel PCM invocation on Linux
# 1. Verify installed version
/opt/pcm/bin/pcm --version

# 2. Restrict ownership and permissions on the install directory
sudo chown -R root:root /opt/pcm
sudo chmod -R go-w /opt/pcm

# 3. Launch with a sanitized environment and absolute paths
sudo env -i PATH=/usr/sbin:/usr/bin LD_LIBRARY_PATH= /opt/pcm/bin/pcm 1