rpcbind rpcinfo EUVD-2026-45950

Exploitation requires a user to actively invoke rpcinfo with the -l flag specifically - this is the code path that copies server-returned address information into the vulnerable fixed-size buffer; other rpcinfo subcommands are not implicated. The attacker must control or compromise an rpcbind server that the victim queries, and that server must be network-reachable from the victim. CVSS UI:R confirms that passive, unsolicited exploitation is not possible - the victim must initiate the connection. Exploitation is limited to crashing the rpcinfo client process only; the local rpcbind daemon, NFS stack, and broader host system are not directly affected. Non-default or misconfigured deployments are not a prerequisite - any use of rpcinfo -l against an untrusted server is sufficient. Stack memory protections (canaries, ASLR) present on modern RHEL systems likely limit exploitation to a crash rather than arbitrary code execution.

CVSS 6.5 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects a constrained real-world risk profile. The UI:R requirement is the critical limiting factor: a user must actively run rpcinfo -l against an attacker-controlled server, preventing passive or opportunistic mass exploitation. The impact ceiling is denial of service of the rpcinfo client process only - the rpcbind daemon and host system are not directly affected, ruling out escalation to RCE or data compromise. Despite CWE-121 (stack-based buffer overflow) typically being a higher-severity class, the CVSS C:N/I:N assignments suggest the overflow does not achieve reliable code execution in practice, consistent with modern stack protections such as stack canaries and ASLR limiting exploitability to a crash. No EPSS data was provided; no KEV listing and no POC code were identified, indicating no confirmed active exploitation at time of analysis. The primary realistic threat is disruption to administrative tooling or automated monitoring scripts querying RPC inventories across environments. Overall priority is low to medium unless rpcinfo is used in automated pipelines against untrusted network segments.

An attacker who has compromised or controls an rpcbind service on a reachable network host configures it to respond to rpcinfo -l queries with crafted oversized address strings. When a system administrator or monitoring script runs rpcinfo -l <attacker-server> - for example during routine RPC inventory or NFS troubleshooting - the rpcinfo client copies the malicious response data into its fixed stack buffer, overwriting adjacent stack memory and crashing the process. No public exploit code has been identified; exploitation relies entirely on the victim initiating the query against the attacker-controlled server.