CVE-2026-43958: Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

Synopsis

A stack-based buffer overflow exists in rrdcached, a daemon component of rrdtool. An attacker with local access and the ability to reach the rrdcached socket can trigger the overflow by sending an oversized CREATE request, requiring only a low-privilege account. Successful exploitation crashes the daemon (denial of service) or enables arbitrary code execution, giving the attacker full control over data integrity and confidentiality on the affected host. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required, only local access to the rrdcached socket.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or root credentials to reach the rrdcached socket.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends the malicious CREATE request directly to the daemon.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout guessing, or other environmental factors are required to trigger the overflow.

Blast Radius

• Crashes the rrdcached daemon, interrupting time-series data collection and any dependent monitoring or graphing services.
• Enables execution of arbitrary code in the context of the rrdcached process, giving the attacker a foothold on the host.
• Reads confidential data accessible to the rrdcached process, including stored metrics and any credentials or tokens present in its memory or working directory.
• Modifies or destroys persisted RRD database files, corrupting historical metrics data.