CVE-2026-16461: rpcbind rpcinfo Buffer Overflow Flaw

CVE-2026-16461 Overview

CVE-2026-16461 is a stack-based buffer overflow [CWE-121] in the rpcinfo utility distributed with rpcbind. The flaw resides in the rpcbdump() short mode code path, which is triggered when an administrator runs rpcinfo -s to query an RPC endpoint. Version numbers returned from a remote RPCBPROC_DUMP reply are copied into a fixed-size stack buffer without bounds checking. A malicious or compromised rpcbind endpoint can return crafted version data that overruns the buffer and crashes the rpcinfo client process.

Critical Impact
A malicious RPC endpoint can trigger a client-side denial of service against any administrator running rpcinfo -s, potentially disrupting RPC service inventory and monitoring workflows.

Affected Products

rpcbind package containing the rpcinfo utility
Linux distributions shipping the vulnerable rpcbind build (Red Hat advisory issued)
Any system where administrators run rpcinfo -s against untrusted RPC endpoints

Discovery Timeline

2026-07-21 - CVE-2026-16461 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16461

Vulnerability Analysis

The vulnerability lives in the rpcbdump() function used by rpcinfo when invoked with the -s (short) option. This mode issues an RPCBPROC_DUMP request to a remote rpcbind service and iterates over the returned program registration entries. For each entry, the utility formats version numbers into a fixed-size stack buffer to display them in condensed form.

The copy operation does not validate the length or count of version values returned by the server. A server that returns an excessive number of versions, or values with oversized string representations, causes the write to exceed the stack buffer boundary. The resulting corruption overwrites adjacent stack data and crashes the rpcinfo client. The attack requires user interaction, as the administrator must invoke rpcinfo -s against the attacker-controlled endpoint.

Root Cause

The root cause is missing bounds checking on data received from an untrusted network peer. The rpcbdump() short-mode routine assumes the remote RPCBPROC_DUMP response contains a bounded number of version entries. Because the destination buffer is stack-allocated with a fixed size, appending unbounded remote input produces a classic stack-based buffer overflow classified under [CWE-121].

Attack Vector

Exploitation requires an attacker to control an RPC endpoint reachable by the victim. The attacker configures a malicious rpcbind service, or compromises an existing one, to return a crafted RPCBPROC_DUMP reply. When an administrator runs rpcinfo -s <target> against the endpoint for reconnaissance or monitoring, the crafted reply is parsed and overflows the stack buffer. The observed impact is a denial of service against the client process. See the Red Hat CVE-2026-16461 Advisory and Red Hat Bugzilla Report #2502719 for upstream analysis.

Detection Methods for CVE-2026-16461

Indicators of Compromise

Unexpected crashes or core dumps produced by the rpcinfo binary on administrator workstations or monitoring hosts
Outbound RPCBPROC_DUMP (procedure 4) traffic on port 111/TCP or 111/UDP directed at untrusted hosts
Rogue rpcbind services responding on non-standard interfaces or from unmanaged hosts on internal networks

Detection Strategies

Inspect crash reports and systemd-coredump records for rpcinfo process terminations with SIGSEGV
Monitor RPC portmap traffic for anomalously large DUMP responses containing excessive program or version entries
Alert on execution of rpcinfo -s against hosts outside approved asset inventories

Monitoring Recommendations

Enable auditd rules to log invocations of /usr/sbin/rpcinfo and /usr/bin/rpcinfo with argument capture
Track version drift of the rpcbind package across the fleet and confirm patched builds are deployed
Baseline expected rpcbind responders on port 111 and flag new or unknown endpoints

How to Mitigate CVE-2026-16461

Immediate Actions Required

Apply the vendor-supplied rpcbind update as soon as it is available in your distribution's repositories
Restrict administrator use of rpcinfo -s to trusted, inventoried RPC endpoints only
Block inbound and outbound traffic to TCP/UDP port 111 at network boundaries where RPC services are not required

Patch Information

Refer to the Red Hat CVE-2026-16461 Advisory for package versions and errata as they are published. Track upstream rpcbind releases through your distribution's security channels and update all systems that carry the rpcinfo client, including jump hosts and monitoring servers.

Workarounds

Avoid running rpcinfo -s against untrusted or externally reachable rpcbind services until patched
Use rpcinfo -p or targeted queries against known-good local endpoints instead of the short-mode aggregation
Segment RPC portmapper traffic with host firewalls (firewalld, nftables, iptables) to limit exposure to unknown endpoints

bash

# Example: restrict outbound rpcbind (port 111) to a trusted subnet using nftables
nft add rule inet filter output ip daddr != 10.0.0.0/24 tcp dport 111 drop
nft add rule inet filter output ip daddr != 10.0.0.0/24 udp dport 111 drop