Threat database

CVE-2026-108985 is a high severity vulnerability in the sahlberg libnfs library affecting versions 0 through 6.0.2. It involves an out-of-bounds write in the ZDR decoding functionality where the maxsize parameter supplied by the caller is not properly enforced. This flaw exists in functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array() within lib/libnfs-zdr.c. The vulnerability can lead to a denial of service due to an out-of-bounds write but does not impact confidentiality.

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.