Core Temp 1.21 fixes a kernel driver flaw that exposes physical memory

Core Temp 1.21 fixes a kernel driver flaw that exposes physical memory

2 November 2026: Core Temp, the free Windows utility that reads processor temperatures, ships a kernel driver whose exposed IOCTL interface lacks proper access control, so physical memory "may be read or written", according to an advisory published on 2 November by Japan's JVN, run by JPCERT/CC and IPA. The flaw, CVE-2026-109836, affects every version before 1.21 and is rated 8.4 on CVSS 4.0. ALCPU, the developer, released version 1.21 on 3 October.

Not yet independently verified. JVN publishes no exploitation status, and ALCPU's changelog names the fix but gives no technical detail. We will update this when it can be confirmed, and remove this note.

How the flaw works

Core Temp needs a kernel driver to read model-specific registers on the processor. JVN classes the bug as CWE-782, an IOCTL exposed with insufficient access control: the driver accepts requests it should refuse, and those requests can reach physical memory.

The scoring sets the attack as local and requiring high privileges (CVSS 4.0 AV:L/AC:L/PR:H, 8.4; CVSS 3.0 6.7). That sounds limited, but a driver that lets an administrator read and write physical memory is exactly what attackers look for in "bring your own vulnerable driver" attacks: once they have admin rights, they load a legitimately signed but flawed driver to switch off endpoint protection or tamper with the kernel, crossing a boundary Windows means to keep closed even to administrators.

Which versions are fixed

• Affected: Core Temp before 1.21.
• Fixed: Core Temp 1.21, released 3 October 2026. ALCPU's changelog lists "Mitigate legacy 64-bit driver Vulnerabilities, JVN#23328936".
• Also in 1.21: a newer compiler that ends support for Windows 2000.

The flaw was reported to IPA by Tamaki Yanagawa, and JPCERT/CC coordinated the fix with the developer.

What administrators should check

Core Temp is common on workstations, gaming and test benches, and in IT tool kits, often installed by hand and never updated. Removing an old copy does not always remove its driver, so it is worth searching endpoints for the Core Temp driver file as well as the application. Where the tool is needed, move to 1.21; where it is not, uninstall it and confirm the driver is gone.

Endpoint teams that maintain a vulnerable-driver block list should add the pre-1.21 driver once a hash is published. JVN does not say whether the flaw has been exploited.

Sources

• JVN: JVN#23328936, Core Temp kernel driver vulnerable to exposed IOCTL with insufficient access control, 2 November 2026
• ALCPU: Core Temp, version history (read 2026-11-02), 2 November 2026