CVE-2026-32791

CVE-2026-32791 is an untrusted search path vulnerability (CWE-426) in Intel PCM — the Performance Counter Monitor utility. An attacker who can write a malicious DLL to any directory PCM searches during module loading can achieve code execution within the PCM process context. This is a well-documented vulnerability class with known mitigations that have existed since the early 2000s, yet it persists in a tool shipped by Intel itself, running with access to hardware performance counters. The CVSS framing obscures the real danger. The 'subsequent system: none' metric doesn't indicate limited blast radius — it indicates surgical precision. PCM doesn't provide persistence across reboots; it provides capability acquisition. Once code executes inside the PCM process, the attacker inherits direct access to hardware performance counters — the same counters that can infer cryptographic key operations, reconstruct instruction patterns, and profile memory access in ways that defeat software-level countermeasures. This is horizontal escalation, not vertical: the attacker doesn't gain root; they gain hardware-level observation of the system that no other userspace process can access. The 'high complexity' rating miscalibrates the actual threat in enterprise environments. The requirement for 'passive user interaction' assumes a consumer model where an authenticated user must be tricked into placing a DLL. In practice, the relevant question is whether a compromised service account, developer workstation, or build system can write to any directory PCM searches during normal operation — a much lower bar than the CVSS implies. In containerized and CI/CD environments where external code is routinely injected into process contexts, the search path attack surface expands significantly. Action items: upgrade PCM to version 202604 or later; audit the directories in PCM's search path and identify which accounts have write access to them; treat performance monitoring tools as threat-adjacent surfaces requiring their own threat model rather than exempting them as 'infrastructure' that isn't a target. The vulnerability class has appeared across NVIDIA, AMD, and other hardware vendors' diagnostic utilities — this is a systemic pattern, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.