libnfs vulnerability in Ubuntu allows remote code execution via ZDR decoding

Ubuntu has released security updates to address a critical vulnerability in libnfs, a client library used for interacting with Network File System (NFS) protocols. The flaw stems from improper enforcement of maximum size bounds during the decoding of ZDR (Zero-length Data Record) packets.

This vulnerability affects multiple Ubuntu releases, including 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. An attacker capable of sending specially crafted network traffic to a system using the affected library could trigger an out-of-bounds write, resulting in either a service crash or arbitrary code execution.

Technical details of CVE-2026-108985

• Defect Class: The vulnerability is categorized as an out-of-bounds write caused by insufficient size bound enforcement.
• Attack Vector: The issue is triggered during ZDR decoding, making it exploitable via specially crafted network traffic.
• Impact: Successful exploitation can lead to a denial of service (DoS) through application crashes or the execution of arbitrary code.
• Affected Versions: The fix is provided in libnfs14 version 5.0.2-1ubuntu3.1 (26.10), 5.0.2-1ubuntu1.2 (26.04 LTS), 5.0.2-1ubuntu0.24.04.2 (24.04 LTS), and libnfs13 version 4.0.0-1ubuntu0.2 (22.04 LTS).

Why it matters

Because libnfs is a common client library for NFS operations, this vulnerability poses a risk to any Linux-based system or networked application that relies on it to process incoming file system traffic. System administrators should prioritize updating the libnfs package to mitigate the risk of remote exploitation.