Executive brief
Performance Co-Pilot (PCP) is a system performance analysis toolkit used to monitor and manage complex IT environments. A vulnerability in its pmproxy service allows a remote attacker to crash the service or potentially view sensitive information stored in the system's memory. This could lead to a disruption of monitoring capabilities and unauthorized access to internal system data.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the `pmLogLoadInDom()` function within the PCP `pmproxy` service. The vulnerability is caused by a bounds check on a string index (`idx`) that is incorrectly guarded by a null-pointer check (`if (acp != NULL)`). In the streaming path used by the logger servlet (`POST /logger/meta`), `acp` is hardcoded to NULL, effectively bypassing the security check. A remote, unauthenticated attacker can send a specially crafted `TYPE_INDOM` record with an arbitrary index value, causing a heap offset to be dereferenced by `strlen` or `strdup`. This results in either a service crash or the leakage of heap memory contents. Exploitation requires the attacker to first obtain a valid archive ID via a `POST /logger/label` request.
Affected products
- Red Hat Performance Co-Pilot (PCP) Red Hat Enterprise Linux 8, 9, 10; OpenShift Container Platform 4
Timeline
- 2026-07-22: disclosed: Reported via Red Hat Bugzilla
- 2026-07-30: advisory: NVD and Red Hat published advisory details