Intel PCM CVE-2026-32791

Intel PCM must be installed and in use on the target system. Exploitation requires the attacker to hold a local authenticated session with at least low-privilege access (PR:L) - unauthenticated or fully remote exploitation is not possible given AV:L. High attack complexity (AC:H) means the attacker must have sufficient knowledge of the environment to correctly identify and pre-position a malicious binary or library in a path PCM resolves before legitimate system paths. A passive interaction from a higher-privileged user is required (UI:P) - that user must run Intel PCM after the attacker's payload is staged. Exploitation is limited to environments where multiple users of differing privilege levels share filesystem access on the same host. Default configurations where PCM is run only by administrators from protected directories significantly limit practical exploitability beyond the baseline CVSS score.

Despite high CIA impact metrics (VC:H/VI:H/VA:H), the overall CVSS 4.0 score of 5.4 (Medium) reflects substantial real-world friction: local access is mandatory (AV:L), attack complexity is high (AC:H - requiring precise path pre-positioning and environmental knowledge), low-privilege authentication is required (PR:L), and a privileged user must passively trigger execution (UI:P). Intel PCM is a niche developer and performance-engineering tool, not a broadly deployed service, which further constrains blast radius. No KEV listing confirms active exploitation, and no public proof-of-concept code has been identified, meaning adversary exploitation at scale is unlikely. The CVSS 3.1-equivalent assessment yields approximately 6.3 (Medium), consistent with the 4.0 score. Real-world prioritization should be low unless PCM is deployed in multi-tenant or shared workstation environments where users of differing privilege levels share the same filesystem paths. The missing vendor CPE vendor field ('n/a') in NVD data is noted - affected scope is confirmed through Intel's own advisory (INTEL-SA-01488).

An authenticated local user with low privileges identifies that a high-privilege administrator regularly runs Intel PCM from a shared or world-writable directory. The attacker pre-positions a malicious DLL or executable with the same name as a library PCM loads, in a directory that appears earlier in the search order than the legitimate path. When the administrator next invokes PCM - no special user interaction beyond normal usage required - the malicious code executes in the context of the higher-privileged user, granting the attacker full control of that user's environment. No public proof-of-concept code is known to exist at time of analysis.