CVE-2026-16461

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.

Moderate. This client-side vulnerability in the rpcinfo utility requires a user or administrator to execute rpcinfo -s against a malicious or compromised rpcbind endpoint. Exploitation can lead to a client crash and denial of service for the rpcinfo process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using the rpcinfo -s command against untrusted, attacker-controlled, or compromised rpcbind hosts. Restrict the use of the rpcinfo utility to trusted internal endpoints or secure test environments only.