Tanium Threat Response CVE-2026-108331

Exploitation requires local access to a host running the Tanium Threat Response client extension (or the Endpoint Configuration Toolset Solution component) with at least low-level privileges on that endpoint (AV:L/PR:L), and no user interaction. Impact is limited to availability (A:L) - a denial of service of the affected client extension - with no confidentiality or integrity effect. The exact feature, input, or configuration that triggers the infinite loop is not described in the available sources. Limiting factors: the attacker must already have local, authenticated access to the endpoint; it is not remotely exploitable, and there is no privilege escalation or data exposure, which substantially constrains real-world risk.

This is a low-severity, low-priority issue and the signals are consistent in pointing that way. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 3.3) describes a local-only (AV:L), low-complexity flaw that requires existing low-level privileges (PR:L) and no user interaction, with impact limited to availability only (A:L) - no confidentiality or integrity exposure. The CWE-674 classification (uncontrolled recursion / loop with unreachable exit) is consistent with a denial-of-service condition rather than code execution. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present; there is no public exploit identified at time of analysis. The vendor-reported vuln.today Decision label is 'monitor', which aligns with the low CVSS and absence of exploitation signals. The main caveat is that the description is extremely sparse - it states only that Tanium fixed an infinite loop in the Threat Response Client Extension - so the exact trigger is not described in the available sources and the availability impact scope (whether it degrades only the client extension or the wider agent/host) cannot be confirmed from the input.

An attacker who already has low-privilege local access to an endpoint running the Tanium Threat Response client extension supplies input or triggers a condition that drives the extension into an infinite loop, consuming CPU and rendering that security component unresponsive. This degrades endpoint telemetry/threat-response coverage on the affected host but does not expose or alter data. No public exploit code or PoC reference is present in the input, and the specific trigger is not described in the available sources.