CVE-2026-16529 is a signed integer overflow in PCP's __pmGetPDU() function that triggers during SASL authentication negotiation. The overflow corrupts internal state in a way that permanently blinds the daemon—it stops responding to subsequent packets and requires manual restart to recover. This isn't a crash-and-recovery scenario; the service enters an unrecoverable corrupted state.
The vulnerability lives in the PDU length handling path where signed counters track buffer sizes. When a malformed packet causes the signed integer to overflow, the resulting negative or wildly incorrect value propagates into state that the daemon never reinitializes. The SASL context adds complexity because authentication state machines accumulate counter state during handshake processing, creating a compound attack surface where corrupting the authentication layer simultaneously corrupts the main protocol handler's state.
For defenders: verify your PCP deployments are on versions that include the fix for this overflow. If you're running PCP in a production monitoring role, treat this as higher priority than CVSS 7.5 suggests—the 'permanent blinding' effect means any exposed daemon that receives a malicious packet stays dark until someone manually intervenes. In a distributed deployment across hundreds of hosts, that's a coordinated outage, not a single-service issue.
The detection challenge is real: you lose the very monitoring capability that might tell you the daemon is unresponsive. Check for PCP processes consuming zero CPU but still running, or implement external health checks that validate the daemon's PDU responsiveness, not just its process existence.
If you cannot patch immediately, restrict network access to PCP ports (typically 4431/TCP for pmcd) to trusted sources. The daemon processes unauthenticated network packets by design, so network isolation is your interim mitigation.