Executive brief
A security vulnerability exists in the rpcinfo utility, a tool used to query RPC service information on Linux systems. If a user or administrator uses this tool to inspect a malicious or compromised server, the tool may crash or stop responding. This issue primarily affects the reliability of the diagnostic tool when interacting with untrusted network endpoints.
Technical details
A stack-based buffer overflow exists in the rpcbdump() function within rpcbind's rpcinfo utility. The vulnerability is caused by the use of unbounded sprintf() calls when formatting version numbers from a remote RPCBPROC_DUMP reply into a fixed 256-byte stack buffer. An attacker can trigger this by hosting a malicious rpcbind endpoint that returns a large number of distinct version strings for a single program. When a victim runs 'rpcinfo -s' against the attacker's host, the buffer is overflown, leading to a crash or denial of service of the client process. As of the advisory date, the issue remains unpatched in upstream rpcbind 1.2.9.
Affected products
- Red Hat rpcbind 1.2.9 and earlier
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-07-20: disclosed: Reported via Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date