rrdcached EUVD-2026-33726

Attacker must have local access to the host running rrdcached and filesystem or network permission to connect to the rrdcached control socket (Unix socket under /var/run/rrdcached/ by default, or a TCP listener if rrdcached was started with -l host:port); the attacker must be able to send a CREATE command with an oversized payload. Limiting factors: CVSS PR:L indicates some authenticated/low-privileged foothold on the system is required, the socket is not exposed by default beyond local users in the rrdcached group, no user interaction is needed (UI:N), and reliable arbitrary code execution is bounded by RHEL stack-protection mitigations (stack canaries, ASLR, NX) - denial of service is the path-of-least-resistance outcome. Exposure is materially higher when administrators have enabled the optional TCP listener for remote collectors without firewalling it.

The CVSS vector AV:L/AC:L/PR:L/UI:N with C:H/I:H/A:H reflects a high-impact local privilege issue: an attacker who can already reach the rrdcached socket (a local user, or a low-privileged service account on the same host) can crash the monitoring daemon and may achieve code execution in its security context. There is no EPSS score, KEV listing, or POC referenced in the supplied intelligence, so real-world exploitation pressure currently appears low and likely opportunistic rather than mass-exploited. The main risk amplifier is deployment-dependent: in environments where rrdcached listens on a TCP socket exposed beyond localhost or where the Unix socket is world-writable, the practical attack surface expands beyond the AV:L assumption - CVSS indicates local vector but operators should verify their socket exposure, as a misconfigured TCP listener could effectively make this remotely reachable. Stack-based overflow exploitation on modern RHEL is constrained by stack canaries, ASLR, and FORTIFY_SOURCE, so reliable code execution is not guaranteed and denial of service is the more probable outcome.

A low-privileged local user on a RHEL monitoring host - or a compromised low-trust service account such as a web or monitoring user - connects to the rrdcached Unix socket and sends a malformed CREATE command with an oversized argument that overflows a stack buffer in the daemon. At minimum, the daemon crashes and monitoring data ingestion halts; with successful exploit development, the attacker could redirect execution to run code as the rrdcached service user, pivoting from a constrained account to the privileges of the monitoring daemon. No public exploit identified at time of analysis, so this remains a plausible but not yet demonstrated chain.