---
id: "CVE-2026-109836"
kind: "vulnerability"
aliases: ["CVE-2026-109836"]
title: "Core Temp: kernel driver lets local users read or write physical memory"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Core Temp", "fixed": ["1.21"], "affected": "< 1.21", "ecosystem": "vendor"}]
ecosystems: []
tags: ["core-temp", "infrastructure", "kernel-driver", "local", "privileged-attacker", "windows"]
not_affected_if: ["core-temp-1.21-or-later", "core-temp-not-installed"]
published_at: "2026-11-03T23:17:25+00:00"
first_seen_at: "2026-11-03T23:45:12+00:00"
updated_at: "2026-11-03T23:47:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109836", "first_seen_at": "2026-11-03T23:45:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:47:34+00:00"}]
---

# Core Temp: kernel driver lets local users read or write physical memory

The Core Temp hardware monitoring tool from ALCPU ships a kernel driver whose exposed IOCTL interface lacks proper access control. An attacker who can call that interface may read or write physical memory, which can lead to full control of the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Core Temp affected < 1.21 fixed 1.21

## How to check

- On Windows, look for Core Temp (Start menu, or Settings > Apps) and open Help/About: any version before 1.21 is affected.
- Also check shared, lab and test PCs, which often have it installed without anyone remembering.
- Winget users: run 'winget list ALCPU.CoreTemp' and compare the version with 1.21.0.
- Also check if other tools you run bundle an older Core Temp driver; the sources do not say whether any do.

## Fix

Update Core Temp to 1.21 (released 3 Oct 2026), which the vendor changelog lists as mitigating the legacy 64-bit driver vulnerabilities (JVN#23328936).

## Timeline

- 2026-11-03T23:45:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109836
- 2026-11-03T23:47:34+00:00 analyst — Primary: JVN#23328936 (JPCERT/CC) says Core Temp before v1.21 affected, local, PR:H; ALCPU changelog says 1.21 (3 Oct 2026) mitigates legacy 64-bit driver, citing the JVN id. No exploitation or PoC reported by sources; no vendor-level technical detail. Fix status 'available' replaces earlier 'none'. Whether the 32-bit driver or other bundlers are affected is unknown.

## Documents

- [advisory] JVN#23328936 Core Temp kernel driver exposed IOCTL https://jvn.jp/en/jp/JVN23328936/
- [fix] Core Temp change log (1.21) https://www.alcpu.com/CoreTemp/history.html

## From the sources

The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_