Executive brief
A security vulnerability exists in the rpcinfo utility, a tool used to query RPC (Remote Procedure Call) services. If a user or administrator uses this tool to inspect a malicious or compromised server, the server can send back specially crafted data that causes the tool to crash. This could disrupt administrative operations or diagnostic tasks, though it does not directly compromise the server running the rpcbind service itself.
Technical details
A stack-based buffer overflow exists in rpcbind's rpcinfo utility within the rpcbaddrlist() and rpcbdump() functions. When a user executes 'rpcinfo -l' or 'rpcinfo -s' against a remote host, the utility uses unbounded sprintf calls to copy address and version information from the server's response into fixed-size stack buffers (128 and 256 bytes respectively). A malicious or compromised rpcbind server can provide overly long protocol strings or an excessive number of version values to trigger the overflow. This results in a process crash (Denial of Service). While the attack is network-reachable, it requires user interaction (UI:R) to initiate the connection to the hostile endpoint. The issue is addressed in rpcbind version 1.2.9.
Affected products
- Red Hat rpcbind 1.2.7-3.el10, 1.2.8 and earlier
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-04-26: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-01: patched: rpcbind 1.2.9 released fixing the issue
- 2026-07-20: advisory: NVD and Red Hat published CVE details
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-16277
- https://bugzilla.redhat.com/show_bug.cgi?id=2462085
- https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d
- https://www.linuxfromscratch.org/blfs/advisories/consolidated.html