Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-16277: rpcbind's rpcinfo utility crashes with malicious server data
CVE-2026-16277 · published 3 months ago
Summary
The rpcinfo utility in rpcbind can crash if it receives bad data from a malicious or compromised server. This could make your system unavailable, but it's not a way for an attacker to steal sensitive information or take control of your system. To protect yourself, update your rpcbind software to the latest version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | rpcbind | All versions |
| Debian:13 | debian | rpcbind | All versions |
| Debian:14 | debian | rpcbind | All versions |
| Debian:11 | debian | rpcbind | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat openshift container platform 4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | rpcbind | All versions |
Original advisory text
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-siz...
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
References
- https://access.redhat.com/security/cve/CVE-2026-16277
- https://bugzilla.redhat.com/show_bug.cgi?id=2462085
- https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c34544...
- https://www.linuxfromscratch.org/blfs/advisories/consolidated.html
- https://security-tracker.debian.org/tracker/CVE-2026-16277 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-16277 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-16277 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
DEBIAN-CVE-2026-16277 · OSV
CVE-2026-16277 · NVD
CVE-2026-16277 · MITRE
UBUNTU-CVE-2026-16277 · OSV
Track software like this
Free during beta