CVE-2026-57918

HighCVSS 7.1/10Last modified Jun 26, 2026

Description

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Jun 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-579197.8PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERCVE-2026-57926.5Authentication bypass by spoofing vulnerability in Hedef Media Promotion Interactive Media Marketing Inc. Related Marketing Cloud (RMC) alloCVE-2026-579207.7Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} enCVE-2026-579217.5In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointCVE-2026-579225.3In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possibleCVE-2026-579237.5In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settingsCVE-2026-579245.3In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile detailsCVE-2026-579255.3In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tagsCVE-2026-579269.8In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackCVE-2026-57936.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services CVE-2026-57944.9A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lCVE-2026-579402.1HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in sys