EUVD-2026-36027
GHSA-379r-2p3h-m47v
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionNVD
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
AnalysisAI
Heap memory corruption in libnfs through 6.0.2 allows a malicious NFS server to trigger an integer overflow in the client's XDR string deserializer when a victim connects to it. The flaw resides in libnfs_zdr_string in lib/libnfs-zdr.c, which failed to validate that an attacker-controlled string size fit within the remaining buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim client to initiate an NFS connection (UI:R) to an attacker-controlled or compromised NFS server that returns a crafted XDR string with an oversized length field processed by libnfs_zdr_string; the vulnerable code path is reached during normal protocol decoding so no special libnfs build-time option is needed, but the target application must actually use libnfs (not the kernel NFS client) and must reach a server the attacker can influence - outbound TCP/UDP 2049 (or whichever port the rogue server advertises) must be permitted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L scores 7.1 (High) but the real-world risk is meaningfully constrained: exploitation requires the victim to initiate an NFS connection (UI:R) to an attacker-controlled or compromised server, and AC:H signals non-trivial conditions to win the overflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a rogue NFS server (or compromises a legitimate one) and lures or coerces a victim - for example a QEMU guest image loader, backup job, or media app linked against libnfs - into mounting or connecting to it. During the initial XDR exchange the server returns a string field with a maliciously large length, triggering the integer overflow in libnfs_zdr_string and corrupting client-side memory to crash the process or potentially achieve code execution in the libnfs-consuming application. … |
| Remediation | Upstream fix available (commit 55c18ea33a83d667f79f0ef209c96895795c729f); released patched version not independently confirmed, so rebuild libnfs from a tree that includes that commit or wait for a post-6.0.2 tagged release and update bundled copies in dependent software such as QEMU. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all production and development systems running libnfs 6.0.2 or earlier; identify which have connectivity to external or less-trusted NFS servers; assess criticality of each system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today