CVE-2026-108985: High severity libnfs libnfs vulnerability
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes(), libnfszdrstring(), and libnfszdrarray(). The caller-supplied maxsize value is not honored.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
The vector indicates network reachability, no privileges, low attack complexity, and user interaction are required. The issue is triggered during ZDR decoding involving libnfs_zdr_bytes(), libnfs_zdr_string(), or libnfs_zdr_array() when a caller-supplied maxsize is not honored.
Which versions are affected?
libnfs through version 6.0.2 is affected before commit 7613236464317bee2d9636f087f995148de4db27. The provided data does not identify a numbered release containing the fix.
What is the potential impact?
The out-of-bounds write can affect integrity and availability. The supplied severity vector indicates no confidentiality impact, low integrity impact, and high availability impact.