PCP pmproxy CVE-2026-16530

The PCP pmproxy service must be running and reachable over the network from the attacker - pmproxy is not enabled by default on all RHEL installations and must be explicitly started and network-exposed. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication is required and exploitation complexity is low once the service is reachable. Exploitation is limited to systems where pmproxy is actively running and accessible on its listening port (default TCP 44322); systems where pmproxy is disabled, firewalled from untrusted networks, or not installed (PCP is an optional package) are not exposed. The scope is unchanged (S:U), meaning exploitation is confined to the pmproxy process itself and does not directly enable OS-level pivot. The 'may enable' language in the description for information disclosure indicates the memory leakage impact is probabilistic rather than guaranteed, contingent on memory layout at exploitation time.

The vendor-assigned CVSS 3.1 score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L contains a notable internal inconsistency: the description explicitly states the flaw 'may enable the leakage of sensitive information from the system's memory,' which implies a confidentiality impact - yet the vector assigns C:N and anomalously assigns I:L (integrity). An out-of-bounds read does not normally produce an integrity impact; this metric appears misassigned, and a more accurate vector would reflect C:L/I:N/A:L. This discrepancy should be verified against the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16530. The vulnerability is not listed in CISA KEV and no POC exploit is identified at time of analysis, indicating low urgency for immediate emergency patching. The network-accessible, unauthenticated attack vector (AV:N/PR:N) lowers the bar for exploitation conceptually, but PCP pmproxy is a monitoring-tier service, not a primary attack surface in most environments - reducing realistic threat exposure. EPSS data is absent from provided intelligence, limiting probabilistic exploitation forecasting. Real-world risk is moderate for organizations that expose pmproxy to untrusted networks, and low for those where pmproxy is restricted to management network segments.

An unauthenticated remote attacker with network access to a host exposing the pmproxy service sends a specially crafted HTTP or PCP protocol request that triggers the pmLogLoadInDom() function with malformed input, causing an out-of-bounds read. The resulting memory access violation crashes the pmproxy daemon, interrupting performance metric collection and proxy services for the affected host. Depending on process memory layout at crash time, fragments of in-process memory (potentially including metric data, credentials, or other co-resident data) may be returned to the attacker before the crash, constituting a limited information disclosure. No public proof-of-concept exploit code has been identified at time of analysis.