{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"libnfs","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPTY0TSNWN3PMYFHYHMJ4B","modified_at":"2026-10-23T17:47:41.553997063Z","published_at":"2026-10-12T03:17:18.837Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-108985","https://security-tracker.debian.org/tracker/CVE-2026-108985"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-108985","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-108985"}],"summary":"ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied max"}