{"id":"AZL-107960","summary":"CVE-2026-108985 affecting package libnfs 5.0.2-2","details":"ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.","modified":"2026-10-13T14:17:41.554083190Z","published":"2026-10-12T03:17:18Z","upstream":["CVE-2026-108985"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108985"}],"affected":[{"package":{"name":"libnfs","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/libnfs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.2-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107960.json"}}],"schema_version":"1.9.0"}