EUVD-2026-56530
GHSA-2m34-p54f-v54v
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector, high complexity for path staging, low-privilege authenticated access required, privileged user interaction needed; no scope change as downstream system impacts are none.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
AnalysisAI
Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Technical ContextAI
Intel PCM is a hardware performance monitoring utility operating in Ring 3 (user space), targeting Intel processors. CWE-426 (Untrusted Search Path) indicates the application resolves executable or library paths from attacker-influenced locations - for example, searching the current working directory, PATH environment variable directories, or DLL search order paths before trusted system locations. A lower-privileged attacker who can pre-position a malicious binary or shared library in a directory that PCM searches at runtime can cause it to load and execute attacker-supplied code when invoked by a higher-privileged user. The CPE (cpe:2.3:a:n/a:intel(r)_performance_counter_monitor_(intel(r)_pcm)) reflects this is an application-level flaw in Intel's own tooling, not a firmware or microcode vulnerability. The CVSS 4.0 metrics confirm the local attack surface (AV:L), high attack complexity (AC:H), and requirement for low-privilege initial access (PR:L) with passive user interaction (UI:P).
RemediationAI
Upgrade Intel PCM to version tag 202604 or later, as identified in the Intel advisory INTEL-SA-01488 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01488.html). The upstream project is open-source; administrators should obtain the patched release from Intel's official PCM repository corresponding to the 202604 tag. Where immediate patching is not feasible, compensating controls include: restricting write access to directories listed in the PATH and library search paths of any account that runs PCM, preventing unprivileged users from writing to the working directory from which PCM is launched, and running PCM only from a controlled directory with restricted write permissions. On Windows, disabling DLL loading from the current working directory via registry or process-level hardening reduces exposure. These mitigations reduce but do not eliminate risk - path control may be difficult in shared environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today