CVE-2016-4359: Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 throug...

Security readout for executives and security teams

CVE-2016-4359 is a remote code execution flaw in the agent component of certain HPE LoadRunner and HPE Performance Center releases. A remote attacker could abuse a buffer overflow in mchan.dll using an overly long server_name value. Treat reachable legacy performance-testing agents as high-risk until confirmed patched or isolated. Exposure is most likely in organizations still running legacy HPE LoadRunner or Performance Center agents from the listed 11.52, 12.00, 12.01, 12.02, 12.20, or 12.50 patch ranges. Risk rises if agent services are reachable from untrusted networks or shared testing environments. Prioritize this for legacy QA and performance-testing environments, especially where agents are network-reachable. The business risk is unauthorized code execution on testing infrastructure, which may still have access to internal systems, credentials, or sensitive test data. Mitigation focus: Identify all HPE LoadRunner and Performance Center agent deployments.; Check exact product versions and patch levels against the HPE advisory.; Apply vendor-supported updates or workarounds from HPE guidance..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.