Skip to main content

rpcbind rpcinfo CVE-2026-16461

| EUVDEUVD-2026-46185 MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-07-21 redhat GHSA-qh7w-564q-qrc7
Buffer Overflow Denial Of Service Stack Overflow Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Suse Red Hat
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network vector because the malicious server is remote; PR:N because no victim-side privileges are required; UI:R because an admin must actively run rpcinfo -s; A:H for client crash; C and I are N as no data exfiltration or modification occurs.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 12:34 vuln.today
CVE Published
Jul 21, 2026 - 11:42 nvd
MEDIUM 6.5

DescriptionCVE.org

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.

AnalysisAI

Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs rpcinfo -s against a malicious or compromised rpcbind endpoint. The flaw is in the rpcbdump() short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.

Technical ContextAI

rpcbind is the ONC RPC port-mapping service present on most Linux distributions, used by NFS, NIS, and other RPC-based services to map program numbers to network ports. The rpcinfo utility is a diagnostic client that queries rpcbind endpoints; its -s flag invokes short-mode output via the rpcbdump() function, which issues a RPCBPROC_DUMP RPC call and iterates over the returned program/version list. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: version numbers from the server response are written sequentially into a statically allocated stack buffer without checking whether the incoming data exceeds its bounds. Because the buffer resides on the stack, overflow can corrupt the return address or saved frame pointers, resulting in a crash (denial of service) of the rpcinfo client process. Affected CPEs confirm the flaw in cpe:2.3:a:red_hat:red_hat_enterprise_linux_8, rhel_9, rhel_10, and openshift_container_platform_4. No heap or kernel-mode code paths are implicated; the scope of impact is restricted to the userspace rpcinfo client process.

RemediationAI

Apply the Red Hat-issued rpcbind package update addressing CVE-2026-16461 via dnf update rpcbind on affected RHEL 8, 9, and 10 systems; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16461 for the specific fixed package version, which was not independently confirmed in the available data. For OpenShift Container Platform 4, follow the OCP-specific errata linked from the same advisory. As a compensating control pending patching, restrict use of rpcinfo -s to queries against known-trusted, internally managed rpcbind endpoints only - avoid running it against any external, cloud-hosted, or third-party RPC servers. Because the flaw only affects the rpcinfo client and not the rpcbind daemon itself, no firewall changes or daemon restarts are required for hosts that are acting as rpcbind servers. The trade-off of restricting rpcinfo usage is reduced diagnostic capability for RPC service enumeration across untrusted network segments, which is a reasonable operational trade-off given the low exploitability in controlled environments.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-16461 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy