illumos reparsed CVE-2026-104115

Requires: (1) a local account on the target host - the reparsed door at /var/run/reparsed_door is readable by all users and the door server performs no caller credential check, so any unprivileged local user qualifies; (2) the svc:/system/filesystem/reparse service must be enabled, which it is NOT by default - this is the primary limiting factor; (3) a crafted nfs-basic reparse request with a host or path component exceeding the 1024-byte stack buffer. Exploitation is further limited to a denial-of-service outcome because default stack protection aborts the process rather than permitting code execution; on a hypothetical system built without stack protection the overflow behavior could differ. No remote vector exists (local door IPC only).

This is a genuinely low-priority, availability-only issue despite the stack-based overflow classification. All signals align toward limited real-world risk: the CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) requires a local, logged-in account, and impact is confined to availability (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - because default stack protection converts the overflow into a controlled abort rather than code execution. The CVSS 4.0 threat metric carries E:P (Proof-of-Concept), indicating POC-level maturity rather than mature/weaponized exploitation; there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation. Two further mitigations sharply reduce priority: the svc:/system/filesystem/reparse service is disabled by default, and the affected operating systems (illumos/OmniOS) have a small deployment footprint. Note a limitation: no EPSS score is provided, so probabilistic exploitation likelihood cannot be quantified, and the discoverer-reported E:P maturity is not independently corroborated by a referenced public exploit.

On an illumos/OmniOS host where an administrator has enabled the reparse service, an unprivileged local user opens the world-readable door at /var/run/reparsed_door and sends an nfs-basic request containing an overlong host or path component. The overflow of the fixed 1024-byte stack buffer in get_fs_locations() trips stack protection, aborting reparsed; repeating the request drives the service into maintenance state, denying reparse functionality. The CVSS threat metric E:P indicates proof-of-concept exploit maturity, and the low attack complexity (AC:L) with no required user interaction makes the crash trivially reproducible for any local user.