This vulnerability involves a signed integer overflow or wraparound in the PCP __pmGetPDU() function within Red Hat Enterprise Linux 10. Exploitation occurs via specially crafted network packets during PDU processing or SASL negotiation, which causes the daemon to become permanently blinded, effectively denying service for all subsequent packet reads. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity and no privileges or user interaction required, but with a high impact on availability. The vendor advisory does not currently specify any patch or remediation status.

Successful exploitation results in a total denial of service (DoS) condition by permanently disabling the affected daemon's ability to process further packets. There is no impact on confidentiality or integrity reported. The service disruption could affect availability of systems running the vulnerable component.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16529 for current remediation guidance. Until a fix is available, consider limiting exposure of the affected service to untrusted networks to reduce risk.