Executive brief
A security flaw was found in rrdcached, a background service used for high-performance data logging and graphing in the RRDtool suite. A local user with access to the service's communication socket can send a specially crafted request that crashes the service or potentially allows them to run unauthorized commands. This could lead to a disruption of monitoring services or unauthorized access to sensitive system data.
Technical details
A stack-based buffer overflow exists in the `handle_request_create()` function within `src/rrd_daemon.c` of rrdcached. The vulnerability is caused by a failure to perform bounds checking on a fixed-size stack array (`av[128]`) when parsing `DS:` and `RRA:` tokens from a `CREATE` request. An attacker with local access to the rrdcached UNIX socket (or a TCP socket if exposed) can provide more than 128 tokens to trigger an out-of-bounds write. This can result in a daemon crash (DoS) or potential arbitrary code execution with the privileges of the rrdcached process. A patch has been proposed to implement proper bounds checking against the array capacity.
Affected products
- Red Hat rrdtool 1.8.0-20.el10
Timeline
- 2026-04-22: other: Reported via OSIDB Bzimport
- 2026-06-01: advisory: NVD and Red Hat published advisory details