{"id":"CVE-2026-109836","kind":"vulnerability","aliases":["CVE-2026-109836"],"related":[],"title":"Core Temp: kernel driver lets local users read or write physical memory","description":"The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.","summary":"The Core Temp hardware monitoring tool from ALCPU ships a kernel driver whose exposed IOCTL interface lacks proper access control. An attacker who can call that interface may read or write physical memory, which can lead to full control of the machine.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Core Temp","fixed":["1.21"],"affected":"< 1.21","ecosystem":"vendor"}],"ecosystems":[],"tags":["core-temp","infrastructure","kernel-driver","local","privileged-attacker","windows"],"not_affected_if":["core-temp-1.21-or-later","core-temp-not-installed"],"how_to_check":"- On Windows, look for Core Temp (Start menu, or Settings > Apps) and open Help/About: any version before 1.21 is affected.\n- Also check shared, lab and test PCs, which often have it installed without anyone remembering.\n- Winget users: run 'winget list ALCPU.CoreTemp' and compare the version with 1.21.0.\n- Also check if other tools you run bundle an older Core Temp driver; the sources do not say whether any do.","fix":"Update Core Temp to 1.21 (released 3 Oct 2026), which the vendor changelog lists as mitigating the legacy 64-bit driver vulnerabilities (JVN#23328936).","status":"open","published_at":"2026-11-03T23:17:25+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","triaged_at":"2026-11-03T23:45:28+00:00","updated_at":"2026-11-03T23:47:34+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T23:45:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Core Temp: kernel driver lets local users read or write physical memory","impact":"high","summary":"The Core Temp hardware monitoring tool from ALCPU ships a kernel driver whose exposed IOCTL interface lacks proper access control. An attacker who can call that interface may read or write physical memory, which can lead to full control of the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","core-temp","kernel-driver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Physical memory read or written, leading to kernel-level takeover","analyst_note":"Confirm affected Core Temp and driver versions, fixed release, and whether the driver is exposed to unprivileged local users, from the NVD entry and vendor advisory.","how_to_check":"- Check whether the Core Temp application or its kernel driver is installed on Windows machines.\n- Affected product versions: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["core-temp-not-installed"],"who_is_affected":"Machines running the Core Temp kernel driver from ALCPU are exposed. The sources do not state affected versions, whether the driver loads by default, or whether a remote path exists; the description points to a local caller reaching the IOCTL. Systems without Core Temp installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4088,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Core Temp and driver versions, fixed release, and whether the driver is exposed to unprivileged local users, from the NVD entry and vendor advisory.","search":"'-109836':15A,18A '-2026':14A,17A 'access':51B,87C 'alcpu':40B,82C 'allow':95C 'attack':31B,54B 'call':57B 'control':52B,71B,88C 'core':1A,19A,22B,34B,76C 'core-temp':21B 'cve':13A,16A 'driver':4A,27B,44B,79C 'expos':46B,91C 'full':70B 'hardwar':36B 'infrastructur':24B 'insuffici':86C 'interfac':48B,59B 'ioctl':47B,92C 'kernel':3A,26B,43B,78C 'kernel-driv':25B 'lack':49B 'lead':68B 'let':5A 'local':6A,28B 'machin':74B 'may':60B,94C 'memori':12A,65B,97C 'monitor':37B 'physic':11A,64B,96C 'privileg':30B 'privileged-attack':29B 'proper':50B 'provid':80C 'read':8A,61B,100C 'ship':41B 'temp':2A,20A,23B,35B,77C 'tool':38B 'user':7A 'vulner':84C 'whose':45B 'window':32B 'write':10A,63B 'written':102C","nicknames":[],"mitigations":[],"who_affected":"Windows PCs and servers running Core Temp (ALCPU) before version 1.21 are affected. JVN rates the attack as local with high privileges required (CVSS 4.0 8.4, CVSS 3.0 6.7), so it is not reachable over the network; an attacker needs to already be on the machine with elevated rights, and could then read or write physical memory through the driver. Machines without Core Temp, or with 1.21 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:47:34Z","by":"analyst","doc":"https://www.alcpu.com/CoreTemp/history.html","run_id":1583},"products":{"at":"2026-11-03T23:47:34Z","by":"analyst","doc":"https://www.alcpu.com/CoreTemp/history.html","run_id":1583},"how_to_check":{"at":"2026-11-03T23:47:34Z","by":"analyst","doc":"https://www.alcpu.com/CoreTemp/history.html","run_id":1583},"who_affected":{"at":"2026-11-03T23:47:34Z","by":"analyst","doc":"https://www.alcpu.com/CoreTemp/history.html","run_id":1583}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["coretemp","temp"],"ptokens":["core","temp"],"labels":["coretemp","high","infrastructure","kerneldriver","local","privilegedattacker","windows"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109836","severity":null,"published_at":"2026-11-03T23:17:25+00:00","modified_at":"2026-11-03T23:17:25+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","fetched_at":"2026-11-03T23:45:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109836:1583","url":null,"severity":null,"published_at":"2026-11-03T23:47:34+00:00","modified_at":"2026-11-03T23:47:34+00:00","first_seen_at":"2026-11-03T23:47:34+00:00","fetched_at":"2026-11-03T23:47:34+00:00","note":"Primary: JVN#23328936 (JPCERT/CC) says Core Temp before v1.21 affected, local, PR:H; ALCPU changelog says 1.21 (3 Oct 2026) mitigates legacy 64-bit driver, citing the JVN id. No exploitation or PoC reported by sources; no vendor-level technical detail. Fix status 'available' replaces earlier 'none'. Whether the 32-bit driver or other bundlers are affected is unknown."}],"documents":[{"id":61712,"url":"https://jvn.jp/en/jp/JVN23328936/","title":"JVN#23328936 Core Temp kernel driver exposed IOCTL","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":61713,"url":"https://www.alcpu.com/CoreTemp/history.html","title":"Core Temp change log (1.21)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}