CVE-2026-108985

HighCVSS 7.1

Published: 12/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

ZDR decoding in libnfs through 6.0.2 before commit 7613236 has an out-of-bounds write in lib/libnfs-zdr.c involving libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

Risk Assessment

Can lead to memory corruption, application crashes, or potential arbitrary code execution in the context of the process using libnfs. Particularly relevant for systems processing untrusted data over NFS.

Recommendation

Update libnfs to a version containing commit 7613236 or later. Until patched, avoid processing untrusted data through this library.

Other vulnerabilities in libnfs

CVE-2026-53689High
A vulnerability in libnfs through version 6.0.2 before commit 55c18ea fails to validate a string size, leading to an integer overflow when connecting to a crafted NFS server. The issue resides in libnfs_zdr_string in lib/libnfs-zdr.c.

Original NVD description (English source)

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS