CVE-2026-108985 - Vulnerability Details - OpenCVE

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Sahlberg	Libnfs

No data.

No data.

References

Link	Providers
https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27

History

Tue, 13 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 12 Oct 2026 04:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sahlberg Sahlberg libnfs
Vendors & Products		Sahlberg Sahlberg libnfs

Mon, 12 Oct 2026 03:15:00 +0000

Type	Values Removed	Values Added
Description		ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.
Weaknesses		CWE-787
References		https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-10-12T03:00:30.330Z

Updated: 2026-10-13T14:24:30.105Z

Reserved: 2026-10-12T03:00:29.548Z

Link: CVE-2026-108985

Vulnrichment

Updated: 2026-10-13T14:24:19.634Z

NVD

Status : Deferred

Published: 2026-10-12T03:17:18.837

Modified: 2026-10-16T19:56:15.773

Link: CVE-2026-108985

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108985", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-12T03:00:29.548Z", "datePublished": "2026-10-12T03:00:30.330Z", "dateUpdated": "2026-10-13T14:24:30.105Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["ZDR decoding"], "product": "libnfs", "programFiles": ["lib/libnfs-zdr.c"], "programRoutines": [{"name": "libnfs_zdr_bytes()"}, {"name": "libnfs_zdr_string()"}, {"name": "libnfs_zdr_array()"}], "repo": "https://github.com/sahlberg/libnfs", "vendor": "sahlberg", "versions": [{"lessThan": "7613236464317bee2d9636f087f995148de4db27", "status": "affected", "version": "0", "versionType": "git"}, {"lessThanOrEqual": "6.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-12T03:00:30.330Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T14:23:51.297508Z", "id": "CVE-2026-108985", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T14:24:30.105Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/sahlberg/libnfs", "vendor": "sahlberg", "modules": ["ZDR decoding"], "product": "libnfs", "versions": [{"status": "affected", "version": "0", "lessThan": "7613236464317bee2d9636f087f995148de4db27", "versionType": "git"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.2"}], "programFiles": ["lib/libnfs-zdr.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "libnfs_zdr_bytes()"}, {"name": "libnfs_zdr_string()"}, {"name": "libnfs_zdr_array()"}]}], "references": [{"url": "https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27", "tags": ["patch"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-12T03:00:30.330Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-108985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T14:23:51.297508Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T14:24:19.634Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-108985", "state": "PUBLISHED", "dateUpdated": "2026-10-12T03:00:30.330Z", "dateReserved": "2026-10-12T03:00:29.548Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-12T03:00:30.330Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}