CVE-2026-16461
Received Received - Intake

Stack-Based Buffer Overflow in rpcbind rpcinfo Utility

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16461
EUVD
EUVD-2026-46185

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rpcbind rpcbind to 1.2.9 (exc)
redhat rpcbind to 1.2.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in rpcbind's rpcinfo utility. When using the `rpcinfo -s` command, version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A malicious endpoint can send enough version numbers to overflow the buffer, causing client-side memory corruption.

Detection Guidance

To detect this vulnerability, check if rpcinfo is installed and if the system uses rpcbind. Run `rpcinfo -s <host>` against remote endpoints. If the command crashes or causes unusual behavior, it may indicate the vulnerability. Use tools like AddressSanitizer to build rpcbind and test for crashes when running `rpcinfo -s` against a known malicious endpoint.

Impact Analysis

If you run `rpcinfo -s` against a malicious or compromised rpcbind endpoint, the rpcinfo client may crash or experience denial of service. This requires no special privileges on your system but could disrupt network service discovery tasks.

Compliance Impact

This vulnerability primarily causes denial of service through client crashes, which does not directly violate GDPR or HIPAA data protection requirements. However, if exploited in systems handling sensitive data, it could lead to service disruptions affecting availability, a key aspect of compliance under both regulations.

Mitigation Strategies

Avoid running `rpcinfo -s` against untrusted or suspicious RPC endpoints. Monitor for crashes in rpcinfo processes. Apply patches if available from your vendor. Since the issue remains unfixed in upstream rpcbind 1.2.9, consider disabling rpcinfo or restricting access to trusted networks until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16461. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart