CVE-2026-16530 describes a bounds check bypass in pmLogLoadInDom() within pmproxy, confirmed to cause denial of service but hedged as potentially enabling information disclosure. The hedged language matters: a crash is a different risk class than memory exposure, with different remediation urgency and stakeholder implications.
The function loads parsed domain data from archived performance logs. That detail is critical — pmproxy is a performance monitoring proxy that aggregates metrics from collection agents across your infrastructure before forwarding to dashboards or alerting systems. It doesn't just read arbitrary heap; it holds structured, correlated data about your infrastructure: hostnames, timestamps, performance baselines, and relationships between systems. If information disclosure is possible, what leaks isn't random noise — it's infrastructure intelligence.
The EPSS score of 0.00299 likely reflects pmproxy's narrow deployment footprint (often localhost-only) and the confirmed DoS path, not the severity of a potential disclosure. But the aggregator position means the blast radius of a leak would exceed what EPSS models — it's not just what the process holds, it's what it has accumulated over time from every host it's ever proxied.
Verify pmproxy's exposure in your environment. Confirm whether it binds only to localhost or listens network-adjacent. If network-adjacent, treat this as higher priority than the EPSS suggests. Apply the patch regardless of the disclosure ambiguity — the DoS is confirmed — but also audit for memory disclosure paths explicitly, since the CVE's hedge may reflect incomplete research rather than confirmed impossibility. Monitor for unexpected service behavior post-patch: a patched DoS that still leaks memory will not trigger crash alerts.