CVE-2026-32791

Executive Summary

CVE-2026-32791 is a locally exploitable privilege-escalation vulnerability in Intel(R) Performance Counter Monitor (Intel(R) PCM) releases prior to version tag 202604. The flaw is an untrusted search path (CWE-426) issue: when a user launches a PCM utility, the process may load a library from a user-influenced directory rather than a trusted system location, allowing an unprivileged authenticated attacker to execute arbitrary code in the context of the PCM application. The NVD description assigns high (H/H/H) confidentiality, integrity, and availability impact to the vulnerable Ring 3 user-application context, but explicitly scores subsequent system impact as none; no CVSS vector, public exploit, or CISA KEV listing exists as of this report.

Technical Analysis

The vulnerability class is CWE-426 — Untrusted Search Path, commonly exploited as DLL preloading/search-order hijacking (MITRE ATT&CK T1574 / sub-technique T1574.007). Intel PCM is a user-mode (Ring 3) toolset used to read processor performance counters, is frequently executed by developers, SREs, capacity planners, and automation jobs, and often runs with elevated privileges (admin/root) so it can access model-specific registers. The NVD description confirms the vulnerable component is the user-space application rather than the kernel ("within Ring 3: User Applications").

The attack mechanism at the class level is as follows: when the PCM executable starts, the OS loader resolves supporting dynamic libraries using a defined search order. If that order includes directories an unprivileged local user can write to — such as the current working directory or a user-modifiable PATH-adjacent location — the loader can be induced to resolve a malicious, attacker-supplied library in place of the legitimate one. Once loaded, the library's initialization code executes with the privileges of the launching process. Because PCM is commonly launched from arbitrary working directories (terminal sessions, shared project directories, analysis scripts), the preconditions are realistic: an authenticated local user, a user-controlled writable directory, and a victim who "passively" launches the tool.

The NVD description stresses the attack is "high complexity" and "requires passive user interaction," and that it can occur "without special internal knowledge." This indicates the attacker does not require specialized processor or system knowledge, but the environmental conditions (directory layout, search path behavior, victim action) must align. Notably, the description reports high impact on the vulnerable system but none on the "subsequent system" — suggesting the escalation is contained within the Ring 3 trust boundary (the elevated user/application context) and does not by itself yield kernel or full-machine compromise.

No public PoC, exploit code, or technical write-up was available at the time of this report; the analysis above is therefore drawn strictly from the NVD description and the CWE-426 vulnerability class. Insufficient technical detail is available to identify specific library names, function names, or affected executable paths.

Exploitation Scenarios

The attack chain is inferred from the CWE-426 vulnerability class; no public PoC is available, so the following steps are scenario-level.

1. Reconnaissance / target identification. The attacker holds an authenticated, unprivileged local account. They enumerate running processes, scheduled tasks, service definitions, or shell history to determine whether Intel PCM is installed and which users or automation accounts launch it. They also identify a directory that is writable by the attacker and that is used as the current working directory when PCM is executed (e.g., a shared scratch, analysis, or project directory).

2. Triggering the flaw. The attacker places a malicious dynamic library — a hijack payload — into that writable directory. The library is named so the loader will resolve it during PCM startup due to the untrusted search path order. Because the attack does not require "special internal knowledge," the attacker does not need deep insight into the processor or the tool's internals; the search-order behavior of the operating system does the work.

3. Payload / execution method. When the victim (or a scheduled performance-monitoring job) launches a PCM tool from that working directory, the OS loader reaches into the attacker-controlled directory before or instead of the trusted system directories. The malicious library's initialization code executes inside the PCM process. If PCM was started with elevated rights (as is common for counter access), the payload inherits those rights, yielding escalation of privilege within the Ring 3 user-application context.

4. Post-exploitation impact. The attacker can read or exfiltrate data accessible to the elevated context (confidentiality), tamper with files or computations (integrity), and cause denial of service of the monitoring workflow (availability). Per the NVD description, "subsequent system" impacts are none — meaning the compromise is expected to remain within the user/application trust boundary and does not by itself enable kernel-level or cross-system propagation.

Impact Assessment

• CVSS: Not published (N/A). The NVD description indicates partial-technical scores of High/High/High for the vulnerable system's confidentiality, integrity, and availability, with subsequent system impact of None/None/None. This describes a meaningful but contained privilege escalation at the user-application layer.
• EPSS: 0.00116 (≈1.9th percentile) — low current likelihood of exploitation in the wild. Not listed on CISA KEV; no known threat-actor campaigns or in-the-wild evidence were identified.
• Affected assets: Systems where Intel PCM (versions before tag 202604) is installed — typically developer workstations, performance-engineering hosts, cloud/compute instances running monitoring agents, and CI/CD nodes executing benchmark or counter-collection jobs. Because these platforms frequently hold high-value source code, credentials, and production telemetry, a successful hijack has outsized business risk despite being "local."
• Blast radius: Local single-host. The "subsequent system: none" qualifier limits the worst-case framing, but lateral movement from a compromised elevated user context remains possible if the same account is reused across the fleet.

Detection Guidance

This vulnerability has no meaningful network footprint — the trigger and payload are local file-system events. Detection should therefore be host-centric: library-load auditing, process telemetry, and file integrity monitoring. The rules below are generic CWE-426 patterns and must be tuned with the exact PCM binary names and paths in your environment; note that specific executable/library names are not published in the NVD description, so placeholders are used where necessary.

Sigma Rule

title: Suspicious Library Load by Intel Performance Counter Monitor Process
id: 98b1a1f0-0000-4000-8000-000000000001
status: experimental
description: >
  Detects image loads from user-writable paths (Temp, AppData, Desktop,
  Downloads) by a process suggesting Intel(R) Performance Counter Monitor
  (Intel(R) PCM). Correlates with CVE-2026-32791 (CWE-426 untrusted search
  path). Tune the process/Image filter to the exact PCM binary names observed
  in your environment.
logsource:
  category: image_load
  product: windows
detection:
  selection:
    EventID: 7
    ImageLoaded|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Desktop\'
      - '\Downloads\'
  filter_system:
    ImageLoaded|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  filter_known_good:
    ImageLoaded|endswith:
      - 'C:\Windows\Microsoft.NET\Framework\'
      - 'C:\Windows\Microsoft.NET\Framework64\'
  condition: selection and not filter_system and not filter_known_good
falsepositives:
  - Installers and updaters that legitimately stage libraries in Temp
  - Debug/profiling tools that load CRT or tracing DLLs from user directories
level: medium

YARA Rule

rule intel_pcm_untrusted_search_path_payload
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "CVE-2026-32791: PE files referencing Intel PCM in user-writable paths"
        cve = "2026-32791"
        date = "2026-05-01"
    strings:
        $s1 = "Performance Counter Monitor" ascii wide nocase
        $s2 = "Intel PCM" ascii wide nocase
        $mz = { 4D 5A }
    condition:
        uint16(0) == 0x5A4D and
        (1 of ($s*)) and
        (filename contains "Temp" or
         filename contains "AppData" or
         filename contains "Desktop" or
         filename contains "Downloads")
}

Note: the filename special variable requires file-scanning with full paths (YARA >= 4.2). The rule flags candidate hijack libraries referencing Intel PCM that reside in user-writable locations; legitimate PCM installs should be excluded by path allowlists.

Suricata IDS Rule

Network detection is of limited value because CVE-2026-32791 is locally triggered. The rule below is a delivery-phase/adjacent-network detector for PE payloads transferred over HTTP and should be tuned to your environment's baseline.

alert http any any -> $HOME_NET any (msg:"CVE-2026-32791 - Potential PE payload delivery over HTTP (adjacent delivery chain for local hijack)"; flow:established,to_client; filemagic:"PE32 executable"; classtype:trojan-activity; reference:cve,2026-32791; sid:10000001; rev:1;)

Elastic Detection

// CVE-2026-32791 - Intel PCM untrusted search path
// Detect library loads (Sysmon Event 7 / ECS 'library' events) from user-writable
// paths. Append the observed PCM process names to process.name to reduce noise.
library where dll.path : (
  "C:\\Users\\*\\Temp\\*",
  "C:\\Users\\*\\AppData\\Local\\Temp\\*",
  "C:\\Users\\*\\Desktop\\*",
  "C:\\Users\\*\\Downloads\\*"
) and dll.path : "*.dll" and not process.name : ("svchost.exe", "explorer.exe", "dllhost.exe")

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
| eval path_lower = lower(ImageLoaded)
| where match(path_lower, "\\\\temp\\\\|\\\\appdata\\\\|\\\\desktop\\\\|\\\\downloads\\\\")
| search NOT ImageLoaded IN ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")
| stats dc(ImageLoaded) as lib_count, values(ImageLoaded) as modules,
         earliest(_time) as first_seen, latest(_time) as last_seen
        by Image, ComputerName, User
| where lib_count > 0
| sort - last_seen

Add a Image filter with your local PCM binary names to reduce false positives.

Wazuh OSSEC Rule

<group name="intel_pcm,">
  <!-- CVE-2026-32791 - Intel PCM: library loaded from user-writable search path -->
  <!-- Requires the Sysmon Event 7 decoder; adjust <if_sid> to your Wazuh
       sysmon image-load parent rule ID if it differs from 92050. -->
  <rule id="100345" level="12">
    <if_sid>92050</if_sid>
    <field name="win.eventdata.imageLoaded" type="pcre2">(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\Desktop\\|\\Downloads\\)</field>
    <description>CVE-2026-32791 - Intel PCM: image loaded from user-writable untrusted search path</description>
    <group>pcm,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, advisory, or patch artifact from any tracked source was identified; versions before tag 202604 remain affected.

1. Immediate mitigations (no patch available):

   • Enforce least privilege: run PCM only under dedicated low-privilege service/user accounts where counter access permits, and remove admin/root tokens from interactive monitoring sessions where possible.
   • Harden launch paths: launch PCM only from trusted, non-user-writable directories; discourage interactive use from shared scratch directories; use absolute paths in scripts, scheduled tasks, and service definitions.
   • Tighten ACLs on the PCM installation directory and on any shared working directories to remove write access for unprivileged users.
   • Enable file integrity monitoring (FIM) on the PCM install tree and flag any new/modified DLL/shared-object files.
   • On Windows, verify that the OS-level safe DLL search order is enforced via group policy and audit Sysmon Event 7 for anomalous loads (see Detection Guidance).

2. Patch / upgrade steps:

   • Monitor Intel's security advisories and the official Intel PCM distribution channel for release tag 202604 or later.
   • When available, upgrade all PCM installs to ≥ tag 202604 and verify integrity via vendor-published hashes or signatures; never accept binaries from unofficial mirrors.

3. Long-term hardening:

   • Apply application allowlisting (e.g., AppLocker/WDAC on Windows, SELinux/AppArmor on Linux) so that only signed/trusted libraries can be loaded by the PCM toolset.
   • Treat performance-monitoring hosts as privileged assets: segment them from general-user workstations, rotate credentials, and apply centralized logging of process creation, library loads, and file writes.
   • Revisit PATH, LD_LIBRARY_PATH, and equivalent environment variables in any scripts that invoke PCM; prefer environment policies that place trusted system directories ahead of user-writable directories.
   • Maintain a software inventory of all PCM deployments, as this utility is frequently installed ad hoc and forgotten — an ideal target for later hijack.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-32791
• CWE-426 (Untrusted Search Path): https://cwe.mitre.org/data/definitions/426.html
• MITRE ATT&CK T1574 — Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/
• Intel Security Center (advisory search for CVE-2026-32791): https://www.intel.com/content/www/us/en/security-center/default.html
• Intel PCM official repository/product page: https://github.com/intel/pcm (monitor for release tag 202604)

In-the-wild evidence: None identified. CVE-2026-32791 is not listed on the CISA Known Exploited Vulnerabilities catalog, no exploit code or Nuclei template exists, EPSS is very low (0.00116), and no threat-actor campaigns referencing this CVE were observed at the time of writing.