This vulnerability exists in the rrdcached daemon of rrdtool on Red Hat Enterprise Linux 10. It is triggered by a stack buffer overflow in the handle_request_create() function when processing unbounded DS/RRA arguments in a CREATE request sent via the rrdcached socket. Exploitation requires local access with low privileges but no user interaction. Successful exploitation can lead to denial of service by crashing the daemon or local privilege escalation through arbitrary code execution. Red Hat has issued patches for this vulnerability in rrdtool packages for multiple architectures and variants of Red Hat Enterprise Linux 10.

The vulnerability allows a local attacker with access to the rrdcached socket to cause a denial of service by crashing the rrdcached daemon or potentially execute arbitrary code with elevated privileges. This compromises the integrity and confidentiality of data managed by rrdtool. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. However, Red Hat rates the security impact as Moderate in their advisories.

Red Hat has released official security updates for rrdtool that fix this stack buffer overflow vulnerability. Users of Red Hat Enterprise Linux 10 should apply the updated rrdtool packages as described in Red Hat advisory RHSA-2026:33731 and related advisories. The vendor advisory provides detailed instructions for applying these updates. No additional mitigations are indicated beyond applying the official patches.