Buffer Overflow Flaw in rpcbind Utility by Red Hat

CVE-2026-16461

What is CVE-2026-16461?

A stack-based buffer overflow vulnerability exists in the rpcinfo utility of the rpcbind service. This flaw occurs when version numbers from a remote RPCBPROC_DUMP response are written to a fixed-size stack buffer without proper bounds checking. As a result, an individual with access to the rpcinfo command could inadvertently execute a command towards a malicious or compromised rpcbind server. This action might cause the rpcinfo client to crash or lead to a denial of service, impairing system availability and reliability. It is crucial for users to ensure they use the latest secure version to mitigate potential risks.

References