CVE-2026-16530

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

This Moderate impact flaw in the PCP pmproxy service allows a remote, unauthenticated attacker to trigger a denial of service or information leakage. The vulnerability stems from a bypassed bounds check in the pmLogLoadInDom() function, which can lead to service instability or memory exposure. Exploitation requires the pmproxy service to be reachable on its default TCP port 44322.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the pmproxy service on TCP port 44322 using firewall rules. Alternatively, if the pmproxy service is not required, it can be disabled to prevent exploitation.

Example to disable pmproxy: sudo systemctl stop pmproxy sudo systemctl disable pmproxy

Note that disabling pmproxy may impact functionality that relies on it. A service reload or restart may be required for changes to take effect.