{"id":"CVE-2026-57918","aliases":["DEBIAN-CVE-2026-57918","EUVD-2026-39647","GHSA-27p2-fpv6-cj8c","MGASA-2026-0438","UBUNTU-CVE-2026-57918","openSUSE-SU-2026:11246-1"],"status":"published","title":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in...","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.003,"percentile":0.23011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2026-06-26T10:54:58Z","modified":"2026-10-28T10:55:37Z","fixes":[{"ecosystem":"Mageia:10","package":"libnfs","fixed_in":["6.0.2-2.2.mga10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:10","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-2.2.mga10"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"sahlberg","product":"libnfs"}],"references":[{"url":"https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a31680de","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57918","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-27p2-fpv6-cj8c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57918.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57918","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0438.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36185","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOJLZCLBA4FYYVRVR6YGNNEBZAVEEQ3G/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-57918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57918","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57918","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-57918","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"published","published":"2026-06-26T10:54:58.162Z","modified":"2026-06-26T12:01:20.691Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-39647","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"published","published":"2026-06-26T10:54:58Z","modified":"2026-06-26T12:01:20Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:24.957062Z"}],"ghsa":[{"id":"GHSA-27p2-fpv6-cj8c","title":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in...","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"published","published":"2026-06-26T12:30:30Z","modified":"2026-06-26T12:30:38Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:09:00.559973Z"}],"nvd":[{"id":"CVE-2026-57918","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"published","published":"2026-06-26T11:16:31.7Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"CVE-2026-57918","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"published","published":"2026-06-26T10:54:58.162Z","modified":"2026-10-28T10:55:37.227542213Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57918","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"withdrawn","published":"2026-06-26T11:16:31.7Z","modified":"2026-06-28T14:00:39.804347937Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-57918","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.","status":"withdrawn","published":"2026-06-26T11:16:00Z","modified":"2026-06-30T22:54:22.798328094Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"MGASA-2026-0438","title":"Updated libnfs package fixes a security vulnerability","description":"libnfs through 6.0.2 before 935b8db has an xid integer underflow in\nREAD_IOVEC in rpc_read_from_socket in lib/socket.c during a connection\nto a crafted NFS server, when the expected pdu size exceeds the absolute\npdu size from the xid/record-marker. (CVE-2026-57918)\n","status":"published","published":"2026-09-23T16:56:55Z","modified":"2026-09-23T17:00:04.671530444Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11246-1","title":"libnfs-devel-6.0.2-1.1 on GA media","description":"These are all security issues fixed in the libnfs-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.079853132Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}