CVE-2026-16277
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Risk Assessment
An attacker can crash the rpcinfo utility, leading to disruption of RPC-related services and potentially causing denial of service for other applications.
Recommendation
Update rpcbind to a version that includes a fix for buffer bounds checking, or apply network restrictions to rpcbind servers.
Other vulnerabilities in rpcbind
See all- CVE-2015-7236High
A use-after-free vulnerability in the xprt_set_caller function in rpcb_svc_com.c in rpcbind version 0.2.1 and earlier allows remote attackers to cause a daemon crash via crafted packets involving a PMAP_CALLIT code.
- CVE-2026-16461Medium
A stack-based buffer overflow was found in rpcinfo utility from rpcbind. In short mode (rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking.
- CVE-1999-0461High
Versions of rpcbind, including Linux, IRIX, and Wietse Venema's rpcbind, allow a remote attacker to insert and delete entries by spoofing a source address.
Original NVD description (English source)
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.