CVE-2026-57918

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
sahlberg	libnfs	< 935b8db712b3c6649bc57ddc276526c4a31680de

References

https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a31680de

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-579197.8PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENER CVE-2026-57926.5Authentication bypass by spoofing vulnerability in Hedef Media Promotion Interactive Media Marketing Inc. Related Marketing Cloud (RMC) allo CVE-2026-579207.7Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} en CVE-2026-579217.5In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint CVE-2026-579225.3In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible CVE-2026-579237.5In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings CVE-2026-579245.3In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details CVE-2026-579255.3In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags CVE-2026-579269.8In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack CVE-2026-57936.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services CVE-2026-57944.9A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account l CVE-2026-579402.1HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in sys