libtirpc CVE-2026-85231

Exploitation requires the target RPC service to be explicitly configured with RPCSEC_GSS using the integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection level - a non-default, Kerberos-backed mode most common on NFS deployments; services without RPCSEC_GSS or using only authentication-level GSS are not affected. The attacker must be an authenticated RPC client (CVSS PR:L), which limits exploitation to parties able to establish a valid GSS security context. No user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The impact is limited to availability (service crash/resource exhaustion); there is no confidentiality or integrity effect.

This is a medium-severity, availability-only Denial of Service with signals that consistently point to a limited real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) indicates network reachability and low complexity but requires at least low-level privileges (PR:L), meaning the attacker must already be an authenticated RPC client; there is no confidentiality or integrity impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals do not conflict: a config-dependent, authenticated, availability-only flaw with no exploitation evidence is a patch-in-normal-cycle issue, not a drop-everything priority. One caveat worth verifying: the description says 'authenticated remote attacker,' and the CVSS PR:L reflects that, but RPCSEC_GSS authentication is Kerberos-based - confirm whether an attacker needs valid credentials or merely a GSS context, as this materially affects exposure.

An attacker who already holds valid RPCSEC_GSS (Kerberos) credentials to a libtirpc-backed RPC service configured for integrity or privacy protection sends a request containing an oversized wrapped-data length field. The server attempts an unbounded memory allocation to accommodate it, exhausting system resources until the service becomes unstable or terminates. No public exploit code was identified in the provided data; exploitation is low-complexity (AC:L) but gated by authentication.