A vulnerability in libnfs allows an attacker to trigger an integer overflow when the library connects to a crafted NFS server. The overflow occurs in the libnfs_zdr_string function, which can corrupt memory and potentially lead to remote code execution or a denial of service. This weakness is identified as CWE‑1284.

The flaw affects the sahlberg:libnfs library in all releases through version 6.0.2, up to the code change identified by commit 55c18ea. The patch in that commit removes the unvalidated string size check, preventing the overflow.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the risk remains significant for systems that establish NFS connections with potentially unauthenticated servers. An attacker who can control the NFS server or force the client to connect to a malicious endpoint can exploit the integer overflow to corrupt memory and gain arbitrary code execution. The attack vector is network-based, requiring the victim to initiate a connection to the crafted NFS server.