{"id":"CVE-2026-108985","details":"ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.","modified":"2026-10-13T07:08:09.444895481Z","published":"2026-10-12T03:00:30.330Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108985.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108985.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108985"},{"type":"FIX","url":"https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27"},{"type":"PACKAGE","url":"https://github.com/sahlberg/libnfs"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sahlberg/libnfs","events":[{"introduced":"0"},{"fixed":"7613236464317bee2d9636f087f995148de4db27"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"6.0.2"}],"source":"AFFECTED_FIELD"}}],"versions":["libnfs-8.0.0","libnfs-7.0.1","libnfs-7.0.0","libnfs-6.0.2","libnfs-6.0.1","libnfs-6.0.0","libnfs-5.0.3","libnfs-5.0.0","libnfs-5.0.2","libnfs-5.0.1","libnfs-4.0.0","libnfs-3.0.0","libnfs-2.0.0","libnfs-1.11.0","libnfs-1.10.0","libnfs-1.9.8","libnfs-1.9.7","libnfs-1.9.6","libnfs-1.9.5","libnfs-1.9.4","libnfs-1.9.3","libnfs-1.9.2","libnfs-1.9.0","libnfs-1.8.0","libnfs-1.7.0","libnfs-1.6.0","libnfs-1.5.0","libnfs-1.4.0","libnfs-1.3.0","libnfs-1.2.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27","target":{"file":"lib/libnfs-zdr.c"},"deprecated":false,"digest":{"line_hashes":["164631683165623167251585025085768947393","210012519154802466834397327605196601944","248217454699497625551190087615852111459","281476536455356748062753448582906737084","135159393035013215687148479841091173660","208109760784319014765225097398425126314","245257056118241552766963356979192298572","75602500052633848099625354653295454276","70039173691747731453745553608359209218","312335751447968829540757011006445867429","252070590923490932455925920037855308639","316025051345939341534255251139586351004","76010569341771107144709567309239213645","306171377958691710904308170579353592643","144238621478303790729818168544069492638","148181785380448474017758164811676441560","151696086664335177967601211869305752234","259383893005319577045750627177609059346","5842846499196656113412318561023848608","256317872995893000816597279289585348988","150284606564235047225703531056057224437","60162144586336377418793915174851206876","53011801609287937996784554447818178462","161205883550407225725613219812545027970","168575873606745078980016711222574262126","20686408773799618853207458171038963254","140542654936176163793162971976616648093","230669230296130073346182280632249575305"],"threshold":0.9},"id":"CVE-2026-108985-28a1eb29","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"277763951527588705401314237017397849252","length":821},"id":"CVE-2026-108985-5094288f","signature_type":"Function","signature_version":"v1","source":"https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27","target":{"function":"libnfs_zdr_string","file":"lib/libnfs-zdr.c"},"deprecated":false},{"id":"CVE-2026-108985-62ae0449","signature_type":"Function","signature_version":"v1","source":"https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27","target":{"file":"lib/libnfs-zdr.c","function":"libnfs_zdr_bytes"},"deprecated":false,"digest":{"length":945,"function_hash":"274342079782378579140473079967469598309"}},{"target":{"file":"lib/libnfs-zdr.c","function":"libnfs_zdr_array"},"deprecated":false,"digest":{"function_hash":"54260953610861608520675050729457161130","length":669},"id":"CVE-2026-108985-660641f9","signature_type":"Function","signature_version":"v1","source":"https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27"}],"vanir_signatures_modified":"2026-10-13T07:08:09Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108985.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}]}