---
id: "CVE-2026-50109"
page: "https://infrastack.ai/live/CVE-2026-50109"
kind: "vulnerability"
aliases: ["CVE-2026-50109"]
title: "Intel PCM: out-of-bounds write lets user-mode code crash the system"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Intel Performance Counter Monitor (PCM)", "fixed": ["commit d626ea0 (April 30, 2026) or later"], "affected": "before commit d626ea0 (April 30, 2026)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "intel-pcm", "linux", "package", "windows"]
not_affected_if: []
published_at: "2026-11-10T17:17:44+00:00"
first_seen_at: "2026-11-10T17:22:43+00:00"
updated_at: "2026-11-10T17:25:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50109", "first_seen_at": "2026-11-10T17:22:43+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html", "first_seen_at": "2026-11-10T17:25:26+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html"]}]
exploit_sources: []
---

# Intel PCM: out-of-bounds write lets user-mode code crash the system

Link for people: https://infrastack.ai/live/CVE-2026-50109 (this .md is for agents)

Intel Performance Counter Monitor has an out-of-bounds write reachable from Ring 3 user applications. An unauthenticated attacker with network access can cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel Performance Counter Monitor (PCM) affected before commit d626ea0 (April 30, 2026) fixed commit d626ea0 (April 30, 2026) or later

## How to check

Check your Intel PCM build: if it was built from a source checkout or package older than commit d626ea0 (April 30, 2026) it is affected. In a git checkout: git merge-base --is-ancestor d626ea0 HEAD (exit 0 means the fix is included). Also check whether a distro package or container image bundles an older PCM.

## Fix

Update Intel PCM to a build that includes commit d626ea0 (April 30, 2026) or later, from https://github.com/intel/pcm. Intel names no release tag.

## Timeline

- 2026-11-10T17:22:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50109
- 2026-11-10T17:25:26+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html — Read Intel INTEL-SA-01528 (released 2026-11-10, HIGH, CVSS 4.0 8.3). Affected: PCM before commit d626ea0 (Apr 30 2026); fix = that commit or later from github.com/intel/pcm. No release tag named; no exploitation or PoC seen; social search skipped (B tier, brand new).

## Documents

- [advisory] INTEL-SA-01528: Intel PCM Software Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html

## From the sources

Out-of-bounds write for some Intel(R) Performance Counter Monitor (Intel(R) PCM) within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_