The rpcinfo utility in rpcbind contains a stack-based buffer overflow (CWE‑121). When a client runs rpcinfo -l against a remote rpcbind service, the server returns address information that is copied into a fixed‑size buffer without proper bounds checking. An attacker can send an oversized response that causes the client to crash, terminating the rpcinfo process. This results in a denial of service affecting the availability of the client system; there is no information disclosure or privilege escalation.

Red Hat Enterprise Linux 10, 8, and 9, as well as Red Hat OpenShift Container Platform 4, ship the rpcbind package that includes the vulnerable rpcinfo utility. Any host running these distributions and executing rpcinfo against a remote rpcbind server is susceptible to the overflow. The attacker only needs to target a client that performs rpcinfo -l on an untrusted rpcbind service.

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1 % suggests a low probability of active exploitation. It is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated; the attacker can send a crafted rpcbind response while the client runs rpcinfo. No authentication or elevated privileges are required. Successful exploitation causes the rpcinfo process to crash, creating a temporary denial of service for the client.