rpcbind rpcinfo CVE-2026-16461

Exploitation requires two concurrent conditions: (1) the attacker must control or have compromised a remote rpcbind endpoint capable of returning a crafted RPCBPROC_DUMP reply with version-number data that exceeds the fixed stack buffer in rpcbdump(); and (2) a user or administrator on the victim system must actively run rpcinfo -s <attacker-endpoint> - the vulnerability is not triggered by passive network exposure or inbound connections to the victim. The rpcinfo -s short-mode flag is the specific code path that invokes the vulnerable rpcbdump() function; other rpcinfo modes are not implicated. The impact is strictly limited to the rpcinfo client process crash; neither the host rpcbind daemon, the kernel, nor any other process is affected (S:U). Exploitation is further limited to RHEL 8/9/10 and OpenShift Container Platform 4 systems with the unpatched rpcbind package installed.

The CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately captures the threat model: the attack is network-reachable but requires active user interaction (UI:R), and the only impact is availability loss (A:H) of the rpcinfo client process itself, not the host or any daemon. Scope is Unchanged (S:U), confirming that even a successful overflow does not escape the rpcinfo process. EPSS data was not provided in the input, so exploitation probability cannot be quantified; however, the manual trigger requirement (an admin must deliberately run rpcinfo -s against an attacker-controlled endpoint) significantly constrains real-world exploitability. No KEV listing and no POC are reported, which is consistent with the narrow exploitation window. The net assessment is a low-priority, real but bounded issue: administrators who use rpcinfo for diagnostics against untrusted or internet-facing RPC endpoints are at risk, whereas environments where rpcinfo is only run against internal, trusted infrastructure face negligible exposure. CVSS does not penalize for the implausibility of an admin targeting a malicious server, so the real-world risk is somewhat lower than the CVSS score implies.

An attacker deploys a rogue rpcbind service on an internet-accessible host (or compromises an existing one) and configures it to return a RPCBPROC_DUMP response containing an abnormally large number of version entries. An administrator troubleshooting RPC connectivity issues runs rpcinfo -s <attacker-host>, causing rpcinfo to call rpcbdump() in short mode, overflow the fixed stack buffer with the attacker-supplied version data, and crash. No public proof-of-concept code has been identified at the time of analysis.