The vulnerability lies in the Performance Co‑Pilot pmproxy service’s pmLogLoadInDom() function, where a missing bounds check allows an attacker to send a crafted request that triggers an out‑of‑bounds read (CWE‑125). This flaw can cause the pmproxy process to crash, resulting in a denial of service. In addition, the read can leak sensitive data from the system’s memory, potentially exposing confidential information. The impact is limited to the pmproxy service; however, denial of service could disrupt monitoring and telemetry functions critical to operations.

Affected vendors include Red Hat and its Red Hat Enterprise Linux releases 6 through 10 as well as Red Hat OpenShift Container Platform 4. All mentioned systems run the pmproxy service on TCP port 44322, which is the point of exploitation. No specific vulnerable version ranges are listed, so all current installations of these products are considered at risk.

The CVSS score of 6.5 indicates a medium severity vulnerability, while the EPSS score of < 1% suggests that actively exploited incidents are rare at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote: an unauthenticated network attacker who can reach port 44322 can exploit the service. Because the failure results in process termination rather than system compromise, the overall risk is moderate, but the denial of service and potential data leakage pose significant operational concerns.