Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-43958: rrdtool rrdcached can crash or run code remotely
CVE-2026-43958 · published 5 months ago
Summary
The rrdcached component used by rrdtool on Debian, Ubuntu (Canonical), and Red Hat Enterprise Linux 8 and 10 can be triggered to overflow its memory by sending an overly large CREATE command. This may cause the service to stop working or allow an attacker with local socket access to execute their own code, risking data loss or exposure. Apply the latest security patches and limit local access to the rrdcached socket to mitigate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | rrdtool | All versions |
| Debian:12 | debian | rrdtool | All versions |
| Debian:13 | debian | rrdtool | All versions |
| Debian:14 | debian | rrdtool | All versions |
| Ubuntu:26.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:14.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:16.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:18.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:20.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:22.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:24.04:LTS | canonical | rrdtool | All versions |
| Ubuntu:25.10 | canonical | rrdtool | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 10.0 extended update support | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 9.6 extended update support | All versions |
Original advisory text
Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service
A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.
References
- https://security-tracker.debian.org/tracker/CVE-2026-43958 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-43958 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-43958 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:33731
- https://access.redhat.com/errata/RHSA-2026:34155
- https://access.redhat.com/errata/RHSA-2026:34156
- https://access.redhat.com/errata/RHSA-2026:68702
- https://access.redhat.com/security/cve/CVE-2026-43958
- https://bugzilla.redhat.com/show_bug.cgi?id=2460932
- https://access.redhat.com/errata/RHSA-2026:71600
- https://access.redhat.com/errata/RHSA-2026:72277
- https://access.redhat.com/errata/RHSA-2026:72278
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published1 Jun 2026
Updated26 Oct 2026
First seen1 Jun 2026
Sources
DEBIAN-CVE-2026-43958 · OSV
CVE-2026-43958 · NVD
UBUNTU-CVE-2026-43958 · OSV
CVE-2026-43958 · MITRE
Track software like this
Free during beta