libnfs includes a ZDR decoding routine that writes beyond the allocated buffer. The caller-supplied maxsize parameter is ignored, allowing an attacker to supply oversized data that overflows the buffer in libnfs_zdr_bytes, libnfs_zdr_string, and libnfs_zdr_array. This out‑of‑bounds write can corrupt memory, potentially leading to a local or remote code execution or crash if the library is used to process untrusted input.

The vulnerability exists in sahlberg’s libnfs library versions up to 6.0.2, including all builds that incorporate the pre‑commit code. Any software or system that links against libnfs before the commit 7613236 is impacted. Systems using libraries derived from those versions without the patch are at risk.

The CVSS score of 7.1 indicates a high severity. Although the EPSS score is not available and the vulnerability is not listed in KEV, the potential for memory corruption means an attacker with sufficient privileges or control over data processed by libnfs could exploit the flaw. Likely attack vectors include local users submitting crafted ZDR data or remote callers interacting with services that parse ZDR payloads, but exact exploitation conditions depend on how the library is used.