A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon by sending an oversized host or path component through the nfs-basic plugin. The vulnerable function copies these components into a 1024-byte stack buffer without length checking, and the service door at /var/run/reparsed_door is world-readable and does not verify caller credentials. An attacker can exploit this to abort reparsed and, after repeated requests, place the svc:/system/filesystem/reparse service into maintenance mode, resulting in a local denial of service.

Affected systems This flaw exists in any illumos distribution that has not incorporated the illumos-gate commit 6a2df4aa5381599179ab6afb3165db81960dee35. Vendors such as OmniOS and illumos-gate are listed as affected.

The CVSS score is 5.4, indicating moderate severity. The exploit requires local access to a system where the reparse point service is enabled, making the attack vector local. There is no publicly available exploit code and the EPSS score is not disclosed, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The dereferenced rewrite of the buffer is a classic stack overflow (CWE-121).