CVE-2026-108985 Details
Description
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.
A vulnerability allowing an out-of-bounds write has been identified in the ZDR decoding process of libnfs, affecting versions through 6.0.2 prior to the commit 7613236. The issue arises in the file 'lib/libnfs-zdr.c' within the functions 'libnfs_zdr_bytes()', 'libnfs_zdr_string()', and 'libnfs_zdr_array()'. The vulnerability occurs because the maxsize parameter provided by the caller is not properly respected, allowing data to be written beyond the allocated buffer.
Users can update to libnfs version 6.0.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libnfs | >= 6.0.0, < 6.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |