CVE-2026-16461
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A stack-based buffer overflow was found in rpcinfo utility from rpcbind. In short mode (rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking.
Risk Assessment
Running rpcinfo -s against a malicious or compromised rpcbind endpoint could crash the rpcinfo client, causing denial of service.
Recommendation
Avoid using rpcinfo -s against untrusted rpcbind servers and apply patches from your OS vendor.
Other vulnerabilities in rpcbind
See all- CVE-2015-7236High
A use-after-free vulnerability in the xprt_set_caller function in rpcb_svc_com.c in rpcbind version 0.2.1 and earlier allows remote attackers to cause a daemon crash via crafted packets involving a PMAP_CALLIT code.
- CVE-2026-16277Medium
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- CVE-1999-0461High
Versions of rpcbind, including Linux, IRIX, and Wietse Venema's rpcbind, allow a remote attacker to insert and delete entries by spoofing a source address.
Original NVD description (English source)
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.