CVE-2026-32791 is an untrusted search path flaw in Intel Performance Counter Monitor (PCM) before release tag 202604. The record scores it 7.0 (High), while Intel rates it 5.4 (Medium). A local authenticated user could escalate privilege. Intel recommends tag 202604 or later.
What's affected
Intel's advisory INTEL-SA-01488 lists Intel PCM versions before release tag 202604 (dated 6 April 2026) as affected. The fix is release tag 202604 or later, available from the Intel PCM releases page on GitHub.
Source conflict to note: the CVE record scores this 7.0 (High) with CVSS 3.1. Intel scores it 5.4 (Medium) with CVSS 4.0, with high attack complexity and passive user interaction. Both are reported here.
Weakness class: CWE-426, untrusted search path.
How to check if you're exposed
Check how PCM was installed. If you built it from source, look at the git tag or commit you built from. If you installed it from a package, read the package version and compare it with the 202604 tag date. PCM is used on performance test and profiling machines, so look there first.
Then check whether PCM runs with elevated privileges, for example through sudo or as a service, since this class of bug matters most when a privileged process looks for files in places a normal user can write to.
What to do now
- Update Intel PCM to release tag 202604 or later from the project's GitHub releases.
- Rebuild any internal tooling or images that bundle PCM.
- Check that directories on the search path of any privileged PCM process are not writable by ordinary users.
- Run profiling tools with the least privilege that works, and avoid leaving them running as services.
- Add PCM to your software inventory so it is not forgotten when the benchmark project ends.
Why it matters
An untrusted search path bug occurs when a program loads a library or runs a helper by looking through a list of directories, and one of those directories can be written to by someone with lower privilege. If the program is running with higher privilege, it can end up running code supplied by the lower privileged user.
It is a local, high complexity issue, and Intel's own score is Medium. That fits a tool that is run by engineers on test machines rather than exposed to a network. The KEV flag is false and Intel does not report exploitation. Developer and profiling tools are often missing from vulnerability scans, which is the main reason to list them.
Quick check
Can this be exploited remotely?
No. Both the record and Intel describe local access.
Where do I get the fix?
Intel points to the PCM releases page on GitHub, tag 202604 or later.
Sources
Last reviewed: 18 October 2026.
