CVE-2026-16530

Summary

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Affected Software

Weaknesses

• CWE-125: Out-of-bounds Read

Workarounds

To mitigate this issue, restrict network access to the pmproxy service on TCP port 44322 using firewall rules. Alternatively, if the pmproxy service is not required, it can be disabled to prevent exploitation.

Example to disable pmproxy: sudo systemctl stop pmproxy sudo systemctl disable pmproxy

Note that disabling pmproxy may impact functionality that relies on it. A service reload or restart may be required for changes to take effect.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-16530
• https://bugzilla.redhat.com/show_bug.cgi?id=2506033

• ←Previous
• Next→