CVE-2026-43958: rrdcached Buffer Overflow Vulnerability

CVE-2026-43958 Overview

CVE-2026-43958 is a stack-based buffer overflow vulnerability in rrdcached, the caching daemon component of rrdtool. A local attacker with access to the rrdcached socket can send an oversized CREATE request to trigger the overflow. The flaw maps to [CWE-121: Stack-based Buffer Overflow] and impacts confidentiality, integrity, and availability of the host running the daemon. Successful exploitation can crash the daemon, producing a denial of service, or potentially enable arbitrary code execution in the daemon process context.

Critical Impact
Local attackers with socket access can crash rrdcached or execute arbitrary code through an oversized CREATE request, compromising data integrity and confidentiality.

Affected Products

rrdtool — rrdcached component
Linux distributions packaging vulnerable versions of rrdtool (see Red Hat advisory)
Monitoring stacks bundling rrdcached (for example, Cacti, Munin, collectd deployments)

Discovery Timeline

2026-06-01 - CVE-2026-43958 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-43958

Vulnerability Analysis

The vulnerability resides in the request-handling path of rrdcached, the daemon that caches Round Robin Database (RRD) updates for rrdtool. The daemon listens on a Unix domain socket or a TCP socket and accepts text-based commands such as CREATE, UPDATE, and FLUSH. When parsing an oversized CREATE request, the daemon writes attacker-controlled data past the bounds of a fixed-size stack buffer.

Exploitation requires local privileges and socket access. The attack vector is local, complexity is low, and no user interaction is required. The flaw affects all three security properties — confidentiality, integrity, and availability — because corrupting the stack can both crash the process and allow control-flow hijacking. The EPSS probability stands at 0.013%, indicating low observed exploitation activity at publication time.

Root Cause

The root cause is missing or insufficient length validation on input passed to the CREATE command handler. The handler copies request data into a stack-allocated buffer without enforcing the buffer's size, allowing adjacent stack frames, saved return addresses, or canary values to be overwritten.

Attack Vector

An attacker with local access to the system, and permission to communicate with the rrdcached socket, connects to the daemon and issues a crafted CREATE request whose argument exceeds the expected length. The malformed request triggers the overflow during command parsing. Depending on compiler hardening (stack canaries, ASLR, PIE) and operating system mitigations, the result ranges from an immediate daemon crash to arbitrary code execution under the user account running rrdcached. Refer to the Red Hat CVE-2026-43958 Advisory and Red Hat Bugzilla #2460932 Entry for vendor-confirmed technical details.

Detection Methods for CVE-2026-43958

Indicators of Compromise

Unexpected termination, segmentation faults, or core dumps from the rrdcached process.
Repeated reconnects to the rrdcached socket from unusual local users or processes.
CREATE commands with anomalously long argument strings observed in daemon logs or socket captures.
Spawning of child processes or shells by the rrdcached parent process.

Detection Strategies

Monitor process integrity for rrdcached, including unexpected exits, restarts, and crash signatures in journald or dmesg.
Inspect access controls on the rrdcached Unix socket (typically under /var/run/rrdcached.sock) and audit which local accounts can connect.
Apply behavioral identification rules that flag unusual child-process creation from monitoring daemons.

Monitoring Recommendations

Enable auditd rules for connect() calls to the rrdcached socket path and for execution of binaries spawned by the daemon.
Centralize rrdcached logs and alert on parse errors, oversized payload warnings, or repeated client disconnects.
Track package versions of rrdtool and rrdcached across the fleet to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-43958

Immediate Actions Required

Apply the security update from your Linux distribution once available; consult the Red Hat CVE-2026-43958 Advisory for fixed package versions.
Restrict access to the rrdcached socket to trusted service accounts only using filesystem permissions.
Disable rrdcached on hosts where caching is not required and have applications write directly through rrdtool.
Audit local user accounts and remove unnecessary shell access on systems running rrdcached.

Patch Information

Vendor fixes are tracked in the Red Hat CVE-2026-43958 Advisory and the Red Hat Bugzilla #2460932 Entry. Update rrdtool to the patched package version provided by your distribution and restart any services that depend on rrdcached.

Workarounds

Bind rrdcached to a Unix domain socket rather than a TCP port, and set the socket mode with -m 0660 and an owning group restricted to authorized accounts.
Run rrdcached under a dedicated unprivileged user with no shell, limiting blast radius if code execution occurs.
Place the daemon inside a systemd unit using ProtectSystem=strict, NoNewPrivileges=true, and RestrictAddressFamilies=AF_UNIX to reduce post-exploitation impact.

bash

# Configuration example: restrict rrdcached socket access
rrdcached \
  -l unix:/var/run/rrdcached/rrdcached.sock \
  -m 0660 \
  -s rrdcached \
  -p /var/run/rrdcached/rrdcached.pid \
  -j /var/lib/rrdcached/journal \
  -b /var/lib/rrdcached/db

# Verify socket permissions
ls -l /var/run/rrdcached/rrdcached.sock
# srw-rw---- 1 rrdcached rrdcached 0 ... rrdcached.sock