Stack-Based Buffer Overflow in rpcbind's rpcinfo Utility

CVE-2026-16277

What is CVE-2026-16277?

A stack-based buffer overflow has been identified within the rpcinfo utility of rpcbind, which occurs when it interacts with remote rpcbind services. The issue arises during the execution of the command rpcinfo -l, where the address information received from the server is copied into a fixed-size buffer without adequate bounds checking. This oversight could potentially allow a malicious or compromised rpcbind server to exploit the vulnerability, leading to a crash of the rpcinfo client and consequently resulting in denial of service. This flaw poses a significant risk to system availability.

References