A stack-based buffer overflow exists in the rpcinfo utility of rpcbind on Red Hat Enterprise Linux 10. Specifically, in the rpcbdump() short mode (triggered by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are copied into a fixed-size stack buffer without bounds checking. This lack of bounds validation can lead to a buffer overflow, causing the rpcinfo client to crash or deny service when interacting with a malicious or compromised rpcbind endpoint. The vulnerability is remotely exploitable without privileges and requires user interaction (running `rpcinfo -s`). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vendor advisory does not currently specify a remediation or patch status.

Successful exploitation results in a denial of service condition for the rpcinfo client due to a crash caused by a stack-based buffer overflow. There is no impact on confidentiality or integrity. The vulnerability requires a user or administrator to run `rpcinfo -s` against a malicious or compromised rpcbind endpoint, which could cause the client to crash and disrupt availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16461 for current remediation guidance. Until a patch is available, avoid running `rpcinfo -s` against untrusted or potentially malicious rpcbind endpoints to prevent triggering the vulnerability.