A high-severity vulnerability (CVE-2026-108985) exists in libnfs versions prior to 5.0.2-4.oe2403sp1. The flaw is an out-of-bounds write in the ZDR decoding functionality related to lib/libnfs-zdr.c, where the maxsize parameter supplied by the caller is not properly enforced. This can lead to integrity loss and denial of service. A patch fixing this issue is available in version 5.0.2-4.oe2403sp1.