CVE-2026-16277: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-16277 is a stack-based buffer overflow (CWE-121) in the rpcinfo utility shipped with the rpcbind package. When a user runs rpcinfo -l or rpcinfo -s against a remote rpcbind service, address and version information returned by the server is copied into fixed-size stack buffers without sufficient bounds checking, allowing a malicious or compromised rpcbind server to crash the rpcinfo client. The vulnerability was reported on 2026-04-26 and publicly disclosed on 2026-07-20, affecting at least rpcbind-1.2.7-3.el10 on Red Hat Enterprise Linux 10. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is two separate unbounded sprintf calls in src/rpcinfo.c. In rpcbaddrlist() (used by rpcinfo -l), fields r_nc_protofmly and r_nc_proto from a RPCBPROC_GETADDRLIST reply are written into a char buf[128] without length validation. In rpcbdump() short mode (used by rpcinfo -s), version values from a RPCBPROC_DUMP reply are appended into a char buf[256] without tracking remaining space — approximately 24 maximum-width decimal version values plus commas are sufficient to overflow the buffer. Exploitation requires a user or administrator to invoke rpcinfo against an attacker-controlled or compromised rpcbind endpoint; no privileges on the victim system are required, but user interaction is necessary. The proposed fix replaces unbounded sprintf calls with bounded snprintf equivalents that track remaining buffer space (Red Hat Bugzilla).

Successful exploitation results in a client-side crash of the rpcinfo process, causing a denial of service. The impact is confined to the rpcinfo client and does not affect the rpcbind service itself; there is no established evidence of confidentiality or integrity compromise, nor of reliable remote code execution. The vulnerability is classified as Moderate by Red Hat because it is limited to a user-invoked diagnostic path and requires explicit interaction with a hostile host (Red Hat Bugzilla, GitHub Advisory).

1. Set up a malicious rpcbind endpoint: Deploy a crafted rpcbind-compatible server or instrumented test responder that returns oversized reply data.
2. Trigger the -l overflow: Configure the malicious server to return a RPCBPROC_GETADDRLIST reply where the r_nc_protofmly and r_nc_proto fields, combined with separators and the semantics string, exceed 128 bytes. Then have the victim run rpcinfo -l <malicious-host> <prog> <vers>.
3. Trigger the -s overflow: Alternatively, configure the server to return a RPCBPROC_DUMP reply listing a single program with approximately 24 or more distinct maximum-width decimal version numbers. Have the victim run rpcinfo -s <malicious-host>.
4. Observe crash: The unbounded sprintf in rpcbaddrlist() or rpcbdump() overflows the fixed-size stack buffer, causing the rpcinfo client process to crash (denial of service). An AddressSanitizer-instrumented build will report a stack-buffer-overflow at the cited call sites (Red Hat Bugzilla).

• Process: Unexpected crash or abnormal termination of the rpcinfo process after querying a remote host.
• Logs: Core dump files or crash reports generated by the rpcinfo process; AddressSanitizer stack-buffer-overflow reports in development/test environments referencing rpcbaddrlist() or rpcbdump() in src/rpcinfo.c.
• Network: Outbound RPC queries (RPCBPROC_GETADDRLIST or RPCBPROC_DUMP) to unexpected or untrusted external hosts initiated by rpcinfo.

A patch has been proposed that replaces unbounded sprintf calls with bounded snprintf equivalents in src/rpcinfo.c; the upstream commit is available at the linux-nfs.org repository (GitHub Advisory). Until a fixed package is released, Red Hat recommends avoiding the use of rpcinfo -l or rpcinfo -s against untrusted, attacker-controlled, or compromised rpcbind hosts, and limiting use of the utility to trusted internal endpoints. Monitor for updated rpcbind packages from Red Hat for RHEL 10 (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was credited to Aisle Research in the Red Hat Bugzilla report. Community discussion has been minimal, with automated aggregators (VulnDB, Vulners, cvefeed.io) picking up the disclosure shortly after publication. No significant vendor statements beyond the Red Hat advisory or notable researcher commentary have been identified (Red Hat Bugzilla).