All vulnerabilities
CVE-2026-108985

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied max

sahlberg libnfs
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7613236464317bee2d9636f087f995148de4db27Fixed versionCVE List
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 7613236464317bee2d9636f087f995148de4db27libnfsCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

Text from CVE List

Affected versions 2

  • libnfsaffected: all versions before 7613236464317bee2d9636f087f995148de4db27CVE List
  • libnfsaffected: all versions through 6.0.2CVE List

References 1