CVE-2026-16529

Summary

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-190: Integer Overflow or Wraparound

Workarounds

To mitigate this issue, ensure that Performance Co-Pilot (PCP) services, specifically pmlogger and pmcd, are not exposed to untrusted networks. By default, these services are configured to listen only on the loopback interface, which prevents remote exploitation. If these default network bindings have been altered, revert them to restrict access to localhost. For pmlogger, ensure the PMLOGGER_LOCAL environment variable is set. If remote access to PCP services is not required, consider implementing firewall rules to block external connections to TCP ports 4330 (pmlogger) and 44321 (pmcd). Changes to network configurations or environment variables may require restarting the affected PCP services for the mitigation to take effect.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References