{"id":"CVE-2026-104115","revision":"093f6b94fdf54722b6e1416726215a75","records":[{"revision":"093f6b94fdf54722b6e1416726215a75","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104115","aliases":[],"title":"Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon","description":"A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (illumos-gate commit 2f172c55), and affects any illumos distribution prior to illumos-gate commit 6a2df4aa.","state":0,"publishedAt":"2026-10-09T14:24:52.028+00:00","modifiedAt":"2026-10-15T18:13:25.024+00:00","affected":[{"ecosystem":"https://illumos.org","name":"service/file-system/nfs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"illumos\",\n                    \"product\": \"illumos-gate\",\n                    \"platforms\": [\n                        \"x86\"\n                    ],\n                    \"collectionURL\": \"https://illumos.org\",\n                    \"packageName\": \"service/file-system/nfs\",\n                    \"repo\": \"https://github.com/illumos/illumos-gate\",\n                    \"programFiles\": [\n                        \"usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c\",\n                        \"usr/src/cmd/fs.d/reparsed/reparsed.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2f172c55ef76964744bc62b4500ece87f3089b4d\",\n                            \"lessThan\": \"6a2df4aa5381599179ab6afb3165db81960dee35\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"6a2df4aa5381599179ab6afb3165db81960dee35\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"git\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"OmniOS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OmniOS\",\n                    \"product\": \"OmniOS\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"any\",\n                            \"lessThan\": \"r151054\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151058\",\n                            \"lessThan\": \"r151058w\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151058w\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151056\",\n                            \"lessThan\": \"r151056aw\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151056aw\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"r151054\",\n                            \"lessThan\": \"r151054bw\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"r151054bw\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"affected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":5.4,"severity":"MEDIUM"}],"references":["https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers","https://illumos.org/issues/18496","https://github.com/illumos/illumos-gate/commit/6a2df4aa5381599179ab6afb3165db81960dee35"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104115","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104115","identifiers":["CVE-2026-104115"]},"retained":false,"historicalAffected":[]}],"coverage":[]}