libnfs through version 6.0.2, before commit 935b8db, contains an xid integer underflow in the READ_IOVEC routine inside rpc_read_from_socket. During a connection to a crafted NFS server, the expected PDU size can exceed the actual size derived from the xid/record marker, causing the integer to underflow. This underflow leads to an out‑of‑bounds memory operation, which may corrupt memory and present a serious risk for code execution or service disruption.

All releases of the sahlberg libnfs library up to and including version 6.0.2 are affected. The vulnerability is rectified by commit 935b8db; applying this commit or any later release that includes it resolves the issue. Systems running older releases are at risk unless the update is applied.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The vulnerability is remote; it requires an attacker to control an NFS server and communicate with the vulnerable client. No exploit evidence is currently available and the EPSS score is not reported, but the fault nature suggests real‑’s KEV not yet a known actively exploited weakness.