# libnfs vulnerability in Ubuntu allows remote code execution via ZDR decoding

> **Key takeaway:** A flaw in libnfs's ZDR decoding process allows for out-of-bounds writes, potentially leading to denial of service or arbitrary code execution.

**Published:** 2026-11-09T13:29:36+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/libnfs-vulnerability-in-ubuntu-allows-remote-code-execution-.html 

## Summary
Ubuntu has released security updates to address a critical vulnerability in libnfs, a client library used for interacting with Network File System (NFS) protocols. The flaw stems from improper enforcement of maximum size bounds during the decoding of ZDR (Zero-length Data Record) packets.

This vulnerability affects multiple Ubuntu releases, including 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. An attacker capable of sending specially crafted network traffic to a system using the affected library could trigger an out-of-bounds write, resulting in either a service crash or arbitrary code execution.

## Technical details of CVE-2026-108985
- **Defect Class:** The vulnerability is categorized as an out-of-bounds write caused by insufficient size bound enforcement.
- **Attack Vector:** The issue is triggered during ZDR decoding, making it exploitable via specially crafted network traffic.
- **Impact:** Successful exploitation can lead to a denial of service (DoS) through application crashes or the execution of arbitrary code.
- **Affected Versions:** The fix is provided in libnfs14 version 5.0.2-1ubuntu3.1 (26.10), 5.0.2-1ubuntu1.2 (26.04 LTS), 5.0.2-1ubuntu0.24.04.2 (24.04 LTS), and libnfs13 version 4.0.0-1ubuntu0.2 (22.04 LTS).

## Why it matters
Because libnfs is a common client library for NFS operations, this vulnerability poses a risk to any Linux-based system or networked application that relies on it to process incoming file system traffic. System administrators should prioritize updating the libnfs package to mitigate the risk of remote exploitation.