A security vulnerability in libnfs versions prior to 5.0.2-4.oe2403sp3 involves an out-of-bounds write in the ZDR decoding functionality. The flaw occurs because the maxsize parameter supplied by the caller is not properly enforced, affecting functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). This vulnerability has been assigned CVE-2026-108985 and is rated with a high severity score of 7.1.