CVE-2023-34351 is a buffer underflow in Intel Performance Counter Monitor (PCM) software, scored 7.5 High. An unauthenticated user may cause denial of service over the network. Intel says builds before 202307 are affected, and the fix is to upgrade to 202307 or later.
What's affected
Intel's advisory INTEL-SA-00954 covers Intel PCM software before version 202307. The fixed version is 202307. Intel scores the CVE 7.5 High with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, matching the record.
The impact is denial of service, not code execution or data loss. The advisory points to the project's GitHub releases page for current builds.
How to check if you're exposed
PCM is open source monitoring software, often built from source or installed as a package. Check how you installed it. If you cloned the repository, look at the tag or commit you built from and compare it with the 202307 release. If you used a package manager, read the package version.
Also check whether any PCM component is listening on a network port in your environment, for example the exporter some teams run for dashboards. A service you can reach from outside its intended network deserves attention first.
What to do now
- Find where PCM runs in your estate, including build servers and monitoring hosts.
- Upgrade to release 202307 or later from the project's GitHub releases page.
- Rebuild any container images or packages that bundled an older copy.
- Restrict network access to any PCM service so that only your monitoring system can reach it.
- Record the version in your asset list.
Why it matters
A buffer underflow reads or writes before the start of a buffer, usually because an index or length is calculated incorrectly. Here Intel rates the effect as availability only, so the likely result is a crash of the monitoring service.
That sounds mild, but monitoring tools are what you rely on when something else breaks. Losing them quietly during an incident is a real cost, and an unauthenticated network path makes the risk easy to reach.
The weakness classes involved are CWE-124 (Buffer Underwrite), CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Intel and NVD agree on 7.5 High for this CVE. Intel names 202307 as the fixed version.
Quick check
Can this lead to remote code execution?
Intel's advisory lists denial of service as the impact, with no confidentiality or integrity impact in the vector.
Where do I get the fix?
Intel points to the PCM GitHub releases page for 202307 or later.
Sources
Last reviewed: 19 October 2026.
