A signed integer overflow in the PCP __pmGetPDU() function can be triggered by specially crafted network packets sent during PDU processing or SASL negotiation. When exploited, the overflow permanently blinds the affected PCP daemon, causing it to fail on subsequent packet reads and resulting in a total denial of service for any client that attempts to communicate further with that daemon.

Systems running Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4 are affected, as the vulnerability resides in the Performance Co‑Pilot (PCP) services present in these distributions.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is exploited over a remote network connection to the PCP services (pmlogger on TCP 4330 and pmcd on TCP 44321). Because the vulnerability can be triggered via network packets, any exposure of these services to untrusted networks constitutes a high‑risk attack vector, even though it is not listed in the CISA KEV catalog.