CVE-2026-16277: Red Hat rpcbind stack buffer overflow in rpcinfo utility

CVE-2026-16277 · Severity: medium · CVSS 6.5 · Published 2026-07-20

A security vulnerability exists in the rpcinfo utility, a tool used to query RPC (Remote Procedure Call) services. If a user or administrator uses this tool to inspect a malicious or compromised server, the server can send back specially crafted data that causes the tool to crash. This could disrupt administrative operations or diagnostic tasks, though it does not directly compromise the server running the rpcbind service itself.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-16277 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16277 being exploited in the wild.
How severe is CVE-2026-16277?
Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; Red Hat OpenShift Container Platform 4 affected.
Is there a fix for CVE-2026-16277?
A patch was published on 2026-06-01: rpcbind 1.2.9 released fixing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16277 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-16277?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in rpcbind's rpcinfo utility within the rpcbaddrlist() and rpcbdump() functions. When a user executes 'rpcinfo -l' or 'rpcinfo -s' against a remote host, the utility uses unbounded sprintf calls to copy address and version information from the server's response into fixed-size stack buffers (128 and 256 bytes respectively). A malicious or compromised rpcbind server can provide overly long protocol strings or an excessive number of version values to trigger the overflow. This results in a process crash (Denial of Service). While the attack is network-reachable, it requires user interaction (UI:R) to initiate the connection to the hostile endpoint. The issue is addressed in rpcbind version 1.2.9.

Affected products

  • Red Hat rpcbind 1.2.7-3.el10, 1.2.8 and earlier
  • Red Hat Red Hat Enterprise Linux 8 affected
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

  • 2026-04-26: disclosed: Initial report in Red Hat Bugzilla
  • 2026-06-01: patched: rpcbind 1.2.9 released fixing the issue
  • 2026-07-20: advisory: NVD and Red Hat published CVE details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.