CVE-2026-53689 Integer overflow in libnfs
An integer overflow in libnfs allows attackers to cause denial of service or potentially execute code via a crafted NFS server connection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53689?
CVE-2026-53689 is a high-severity vulnerability in sahlberg libnfs, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
Weakness: CWE-1284
Which versions are affected by CVE-2026-53689?
Linux distribution packages (16)
libnfs SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server 16.0 | All versions | 5.0.3-160000.4.1 |
libnfs SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.11.0-150000.3.3.1 |
libnfs SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 5.0.3-160000.4.1 |
libnfs SUSE:Linux Micro 6.1 | All versions | 5.0.2-slfo.1.1_2.1 |
libnfs openSUSE:Leap 16.0 | All versions | 5.0.3-160000.4.1 |
How do I fix CVE-2026-53689?
Apply the vendor's patch.
Is CVE-2026-53689 being exploited?
There is no known exploitation of CVE-2026-53689 in the wild and no public exploit code.
Sources
Also known as AZL-90153, DEBIAN-CVE-2026-53689, GHSA-379r-2p3h-m47v, MGASA-2026-0299, OESA-2026-2953, OESA-2026-2954 and 9 more.