An untrusted search path in Intel Performance Counter Monitor (PCM) allows user-mode programs to load an arbitrary executable before the intended system binary, enabling an attacker to gain higher privileges. The flaw is classified as CWE-426 and could compromise confidentiality, integrity, and availability at a high level. The attack requires an authenticated local user and is considered high complexity, with no special internal knowledge beyond accessing the affected system.

The vulnerability affects Intel PCM releases prior to the 202604 tag. Systems running any earlier version of the Intel Performance Counter Monitor are potentially vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of <1% suggests a low probability of successful exploitation. The flaw is not listed in the CISA KEV catalog, reinforcing its lower exploitation likelihood. Exploitation requires local access and active user interaction, so it is not remotely exploitable without additional pre‑conditions.