🟠 High | Source: Microsoft Security Response Center
CVE-2026-16277 is a stack buffer overflow vulnerability in rpcbind, specifically within the rpcinfo rpcbaddrlist() function. Stack buffer overflows can allow attackers to overwrite memory and potentially execute arbitrary code, depending on how the vulnerable function handles untrusted input. This vulnerability is relevant to Azure environments where Linux-based workloads or services rely on rpcbind for RPC service discovery.
Security Architect’s Take: Audit Azure Linux VMs and container workloads for exposed rpcbind services and apply vendor patches immediately; consider blocking external access to rpcbind (port 111) via NSGs and Azure Firewall as a compensating control where patching cannot be applied at once.
Original advisory: CVE-2026-16277 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()