CVE-2026-16461 in Red Hat
Summary
by MITRE • 07/21/2026
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability under examination represents a classic stack-based buffer overflow within the rpcbind utility's rpcinfo component, specifically manifesting in the rpcbdump() function when operating in short mode. This flaw occurs when the rpcinfo command executes with the -s flag, which triggers the retrieval of remote RPC service information from a target rpcbind endpoint. The vulnerability stems from improper input validation where version numbers returned by a remote RPCBPROC_DUMP reply are directly copied into a statically allocated stack buffer without any size verification or bounds checking mechanisms. This fundamental flaw in memory management creates an exploitable condition that allows malicious actors to manipulate the program's execution flow through controlled input data.
The technical implementation of this vulnerability operates through the rpcinfo utility's interaction with remote rpcbind services, where the short mode functionality attempts to parse and display RPC service information. When the rpcbdump() function processes version numbers from a remote reply, it assumes a predetermined buffer size sufficient for all possible responses without validating the actual data length received. This assumption breaks down when confronted with maliciously crafted replies that exceed the allocated stack buffer capacity, leading to memory corruption that overwrites adjacent stack frames and potentially executable code segments. The vulnerability specifically targets the rpcinfo utility's client-side processing logic, making it particularly dangerous in environments where administrators routinely execute network service discovery commands against untrusted endpoints.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to encompass potential system compromise and availability degradation. When exploited, the buffer overflow can cause the rpcinfo client process to crash abruptly, rendering the utility unusable for legitimate network administration tasks. More critically, in environments where automated systems rely on rpcinfo for service discovery or monitoring purposes, this vulnerability could facilitate sustained denial of service attacks that disrupt critical infrastructure operations. The vulnerability affects any system running rpcbind versions that include the affected rpcinfo utility, particularly impacting Unix-like operating systems and network services that depend on RPC binding mechanisms for inter-process communication.
Mitigation strategies for this vulnerability should encompass both immediate defensive measures and long-term architectural improvements to prevent similar issues in network service utilities. The most direct approach involves patching the rpcbind software to implement proper bounds checking within the rpcbdump() function, ensuring that version numbers from remote replies are validated against the allocated buffer size before copying operations occur. System administrators should also implement network segmentation controls and access restrictions that limit which hosts can query rpcbind services, reducing the attack surface for potential exploitation attempts. Additionally, organizations should consider implementing runtime protections such as stack canaries or address space layout randomization to make successful exploitation more difficult. This vulnerability aligns with CWE-121 Stack-based Buffer Overflow and relates to ATT&CK technique T1068, which covers local privilege escalation through exploitation of software vulnerabilities. The remediation efforts should also include regular security assessments of network service utilities and implementation of defensive coding practices that prevent similar buffer overflow conditions in other system components.