CVE-2026-108985

Status: DeferredHigh (7.1)—

Severity7.1High · CVSS 3.1

Exploitation probability0.18 %higher than 7% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

CVSS

Base score: 7.1
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.18 %
Percentile among all scored CVEs: 7
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1203 Exploitation for Client Executionexecution85 %
Primary impactT1059 Command and Scripting Interpreterexecution75 %
Secondary impactT1499.004 Application or System Exploitationimpact60 %

CVSS AV:N UI:R indica explotación en cliente; out-of-bounds write (CWE-787) en funciones de decodificación puede permitir ejecución de código o negación de servicio. NFS es protocolo de red, requiere interacción del usuario para procesar datos malformados.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Restrict Web-Based Content Privileged Account Management Limit Software Installation Filter Network Traffic Execution Prevention Behavior Prevention on Endpoint

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Libnfs — Libnfs^AI

CWEs

CWE-787

References

Show 1 references

https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-108985",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-108985",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-13T14:23:51.297508Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "repo": "https://github.com/sahlberg/libnfs",
          "vendor": "sahlberg",
          "modules": [
            "ZDR decoding"
          ],
          "product": "libnfs",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7613236464317bee2d9636f087f995148de4db27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.2"
            }
          ],
          "programFiles": [
            "lib/libnfs-zdr.c"
          ],
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "libnfs_zdr_bytes()"
            },
            {
              "name": "libnfs_zdr_string()"
            },
            {
              "name": "libnfs_zdr_array()"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-12T03:17:18.837",
  "references": [
    {
      "url": "https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored."
    }
  ],
  "lastModified": "2026-10-16T19:56:15.773",
  "sourceIdentifier": "cve@mitre.org"
}