libnfs CVE-2026-53689

libnfs is a portable C client library by Ronnie Sahlberg that implements the NFS protocol (v3/v4) and its underlying XDR (External Data Representation) encoding, widely embedded in tools such as QEMU, KVM, and various media/storage utilities to talk to NFS servers without a kernel mount. The vulnerable routine libnfs_zdr_string decodes a length-prefixed XDR string off the wire and previously consumed the attacker-supplied 32-bit size without comparing it against the remaining ZDR buffer size, matching CWE-1284 (Improper Validation of Specified Quantity in Input). The upstream commit 55c18ea adds an explicit if (size > zdrs->size) return FALSE; guard, confirming the root cause is a missing bounds check that allowed integer/size arithmetic to wrap and subsequent reads/writes to operate on under-allocated memory.