https://bugzilla.redhat.com/showbug.cgi?id=2462085 [CVE-2026-16277] & https://bugzilla.redhat.com/showbug.cgi?id=2502719 [CVE-2026-16461] disclose a pair of related buffer overflows in the rpcinfo command from ONC RPC (aka Sun NFS) when parsing & printing the information returned from a remote rpcbind server.

CVE-2026-16277 covers an overflow when using the -l option: c char buf[128]; sprintf (buf, "%s/%s/%s ", re->rncprotofmly, re->rncproto, re->rncsemantics == NCTPICLTS ? "clts" : re->rncsemantics == NCTPICOTS ? "cots" : "cotsord"); CVE-2026-16461 covers another overflow when using the -s option: c char buf[256]; char p = buf; for (vl = rs->vlist; vl; vl = vl->next) { sprintf (p, "%d", vl->vers); p = p + strlen (p); if (vl->next) sprintf (p++, ","); } The bug reports note they were generated with AI analysis. Red Hat credits Aisle Research for reporting both issues, and Michalis Vasileiadis (GitHub: vmihalis) for reporting CVE-2026-16277 in their advisories at: https://access.redhat.com/security/cve/cve-2026-16277 https://access.redhat.com/security/cve/cve-2026-16461

A fix for CVE-2026-16277 for Linux NFS is published at: https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Unfortunately, that server seems overloaded and I haven't found if it has a fix for CVE-2026-16461 or not yet.

NetBSD appears to have fixed both in 2011: https://github.com/NetBSD/src/commit/e95e36baeccc24159378f422fd3dffb97979b415

OpenBSD's rpcinfo does not support the affected options (it uses -s for a different function, and has no -l option).

Fixes for both for OpenSolaris-based distros were integrated in 2010: https://github.com/illumos/illumos-gate/commit/791dfaa708ef5838f55bf4e97e7c960beb186419

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris