Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach exposed PCP daemon port
  2. Delivery
    Send crafted PDU during read/SASL negotiation
  3. Exploit
    Trigger signed integer overflow in __pmGetPDU()
  4. Execution
    Corrupt packet-read state permanently
  5. Impact
    Monitoring daemon blinded, total DoS

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network reachability to a listening PCP daemon (e.g., pmcd on TCP 44321) that processes the crafted PDU through __pmGetPDU(); the CVSS vector's PR:N is corroborated by the description stating the overflow can be reached during SASL negotiation, meaning the malicious packet is parsed before authentication completes, so no valid credentials are needed. No special product configuration, user interaction, or non-default mode is called out - the vulnerable code is in the standard PDU-read path. The primary limiting factor is network exposure: the attacker must be able to reach the daemon's listening port, so deployments where PCP listeners are bound to loopback or firewalled to trusted management segments are not remotely exploitable. Impact is limited to denial of service (A:H, with C:N/I:N) - no code execution or data access results.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: the SASL-negotiation trigger confirms exploitation is possible before authentication (PR:N), the flaw is reached by a single crafted packet with no user interaction (AC:L/UI:N), and impact is confined to availability with no confidentiality or integrity loss, capping the base score at 7.5 (High). No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input - this is a High-severity but availability-only issue, not a code-execution or data-breach threat. Real-world priority depends heavily on network exposure: if pmcd is reachable only on trusted management segments the practical risk is moderate, whereas an internet- or tenant-exposed daemon faces a trivially repeatable, permanent-outage attack. The 'permanent' blinding (manual restart needed) raises operational severity above a transient crash, but the absence of any exploitation-in-the-wild signal suggests this is not currently a widespread active threat.
Exploit ScenarioDerived

An attacker with network reach to a PCP collector sends a single crafted PDU - either as a normal metric-fetch packet or during the initial SASL authentication exchange - whose length field triggers the signed integer overflow in __pmGetPDU(). The daemon's packet-read logic is permanently corrupted and stops processing all subsequent packets, taking monitoring offline until an administrator manually restarts the service; no authentication is needed and no public exploit code is currently known.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).

RemediationAI

Apply the updated Performance Co-Pilot (pcp) packages for your RHEL major version once Red Hat publishes them; a released patched version is not independently confirmed from the provided data, so track the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16529 and Bugzilla 2506032 for the exact fixed package NVR for your stream. Until patched packages are installed, reduce exposure by restricting network reachability of the pmcd daemon: firewall or bind PCP listener ports (default TCP 44321, plus pmproxy 44322 and pmwebd) so only trusted management hosts can connect, which prevents untrusted senders from delivering the crafted PDU at the cost of losing remote metric collection from those blocked hosts. Where remote PCP collection is not required, disable and stop the pmcd/pmproxy services entirely to remove the attack surface, accepting the loss of that host's performance telemetry. Monitor for unexpected pmcd unresponsiveness and configure service auto-restart (e.g., systemd Restart=on-failure) as a stopgap to recover availability after a triggered outage.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Performance Co-Pilot is an open-source distributed monitoring framework whose collector daemon (pmcd) and agents exchange fixed-format Protocol Data Units (PDUs) over the network, typically on TCP port 44321. The __pmGetPDU() function is the core routine that reads the PDU header, extracts the declared length field, and validates/allocates the buffer for the remaining payload. CWE-190 (Integer Overflow or Wraparound) applies here because the length arithmetic is performed on a signed integer: a crafted value causes the computed size or offset to wrap around a signed boundary, leaving the daemon's read state machine in a corrupted condition. Because the same PDU-reading path is reached both during ordinary metric requests and during the initial SASL authentication handshake, the overflow can be triggered before any authentication completes, and the corruption is persistent rather than a one-time crash - the daemon is left permanently unable to read further packets.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Single crafted packet reaches the flaw pre-authentication during SASL negotiation (AV:N/AC:L/PR:N/UI:N); impact is a persistent daemon outage only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

Executive ViewAI

Why It Matters

A high-severity denial-of-service vulnerability in Performance Co-Pilot affects monitoring infrastructure across RHEL 6-10 and OpenShift Container Platform 4, allowing unauthenticated attackers to permanently disable performance monitoring daemons. Organizations relying on PCP for system visibility and troubleshooting will lose critical operational monitoring until manual service restart, impacting incident response and system management capabilities.

Business Impact: High
Compensating Controls

Network firewall rules restricting access to PCP daemons (pmcd, port 44321) to authorized monitoring clients only; real-time alerting on unexpected PCP daemon restarts; network-based intrusion detection tuned to detect crafted PDU packets during SASL authentication negotiation.

Threat Intelligence Overview

EPSS Score
0.3%
Top 79% exploitable
Prevalence
High
PCP bundled with all supported RHEL versions and OpenShift, large enterprise footprint
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-16529 ADVISORY https://vuldb.com/vuln/384617 REF https://access.redhat.com/errata/RHSA-2026:55560 REF https://access.redhat.com/errata/RHSA-2026:55617 REF https://access.redhat.com/errata/RHSA-2026:55740 REF https://access.redhat.com/errata/RHSA-2026:72272 REF https://access.redhat.com/errata/RHSA-2026:72273 REF https://access.redhat.com/errata/RHSA-2026:72593 REF https://access.redhat.com/errata/RHSA-2026:72594 REF https://access.redhat.com/errata/RHSA-2026:73767 REF https://access.redhat.com/errata/RHSA-2026:74612 REF https://access.redhat.com/errata/RHSA-2026:74613 REF https://access.redhat.com/security/cve/CVE-2026-16529 REF https://bugzilla.redhat.com/show_bug.cgi?id=2506032

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy