CVE-2026-16529Pcp: pcp: denial of service due to signed integer overflow

Description

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

Timeline

Scores

EPSS (exploitation in 30 days)

0.48% · top 58% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:7.0.3-5.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:6.3.7-1.el10_0.1 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:5.3.7-22.el8_10.5 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:5.2.5-8.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:5.2.5-8.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:5.3.5-10.el8_6.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:5.3.5-10.el8_6.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:5.3.7-19.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:5.3.7-19.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:6.3.7-8.el9_8.4 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:6.0.1-8.el9_2.2 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:6.2.0-5.el9_4.2 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:6.3.7-1.el9_6.1 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: unaffected

What to do

Workaround: To mitigate this issue, ensure that Performance Co-Pilot (PCP) services, specifically `pmlogger` and `pmcd`, are not exposed to untrusted networks. By default, these services are configured to listen only on the loopback interface, which prevents remote exploitation. If these default network bindings have been altered, revert them to restrict access to localhost. For `pmlogger`, ensure the `PMLOGGER_LOCAL` environment variable is set. If remote access to PCP services is not required, consider implementing firewall rules to block external connections to TCP ports 4330 (pmlogger) and 44321 (pmcd). Changes to network configurations or environment variables may require restarting the affected PCP services for the mitigation to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-50977 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-16529](https://cveledger.app/badge/CVE-2026-16529.svg)](https://cveledger.app/cve/CVE-2026-16529)

Record last updated 4 Nov 2026, 22:09 UTC.