Tanium Performance CVE-2026-108309

Requires local access to a host running the Tanium Performance client extension (CX) or the Endpoint Configuration Toolset Solution, plus low-level privileges on that host (CVSS PR:L), with no user interaction. The specific feature input or operation that drives the uncontrolled resource consumption is not described in the available sources. Exploitation is limited by the local attack vector (AV:L - no remote/network path) and by the need for pre-existing authenticated access; impact is confined to availability of the affected endpoint agent, with no confidentiality or integrity consequence and no scope change to other components.

This is a moderate-severity, availability-only issue rather than a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity attack requiring low-level privileges, with no confidentiality or integrity impact and high availability impact - consistent with the CWE-770 uncontrolled-resource-consumption / denial-of-service classification. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so there is no signal of active or probable exploitation. The vuln.today decision label is 'this_month', which aligns with a patch-available, non-emergency DoS: schedule remediation in the normal cycle rather than treat it as an incident. The main caveat is that the vendor-supplied description is extremely terse ('uncontrolled resource consumption in Performance Client Extension') and gives no trigger mechanism, so the practical difficulty of causing the resource exhaustion cannot be judged beyond the CVSS metrics; the SSVC-style signals (automatable, exploitation status) were not provided and cannot be inferred. Net: a real but low-urgency, local DoS against a specific enterprise agent - patch on the monthly cycle.

An attacker who already has low-privileged local access to a host running the Tanium Performance client extension (or the Endpoint Configuration Toolset) supplies input or triggers an operation that the extension fails to bound, causing uncontrolled consumption of memory, CPU, or another resource and crashing or hanging the agent. The impact is limited to denial of service on that endpoint; there is no confidentiality or integrity effect. No public exploit code is known, and the exact trigger is not described in the available sources.