CVE-2026-85977
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
51/100
Published: 2026-10-16
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
None
I:
None
A:
High
Description
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.