Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Conclusion & alert: CVE-2003-0028 is rated High Exploit Risk (76.9/100): CVSS High severity, with high exploitation likelihood (EPSS 56.05%, 98th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-30 | 58.40% | 56.05% | -2.35% |
| 2 | 2025-03-29 | 56.05% | 58.40% | +2.35% |
| 3 | 2025-03-17 | — | 56.05% | — |
Full EPSS history (8 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2003-0028 not yet assigned priority: Debian including 3 source packages (dietlibc, glibc, krb5), 15 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 15. | https://security-tracker.debian.org/tracker/CVE-2003-0028 |
redhat
|
critical | — | https://access.redhat.com/security/cve/CVE-2003-0028 |
suse
|
medium | CVE-2003-0028 severity moderate: SUSE including 5 source package names (libtirpc, libtirpc-devel, libtirpc-netconfig, libtirpc3, libtirpc3-32bit), 150 product×package rows across 38 product lines (SUSE CaaS Platform 4.0, SUSE Enterprise Storage 7, … (38 product lines)): Known Not Affected 150. | https://www.suse.com/security/cve/CVE-2003-0028/ |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| gnu | glibc | 2.1 | cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.1.1 | cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.1.2 | cpe:2.3:a:gnu:glibc:2.1.2:*:*:*:*:*:*:* |
| gnu | glibc | 2.1.3 | cpe:2.3:a:gnu:glibc:2.1.3:*:*:*:*:*:*:* |
| gnu | glibc | 2.2 | cpe:2.3:a:gnu:glibc:2.2:*:*:*:*:*:*:* |
| gnu | glibc | 2.2.1 | cpe:2.3:a:gnu:glibc:2.2.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.2.2 | cpe:2.3:a:gnu:glibc:2.2.2:*:*:*:*:*:*:* |
| gnu | glibc | 2.2.3 | cpe:2.3:a:gnu:glibc:2.2.3:*:*:*:*:*:*:* |
| gnu | glibc | 2.2.4 | cpe:2.3:a:gnu:glibc:2.2.4:*:*:*:*:*:*:* |
| gnu | glibc | 2.2.5 | cpe:2.3:a:gnu:glibc:2.2.5:*:*:*:*:*:*:* |
| gnu | glibc | 2.3 | cpe:2.3:a:gnu:glibc:2.3:*:*:*:*:*:*:* |
| gnu | glibc | 2.3.1 | cpe:2.3:a:gnu:glibc:2.3.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.3.2 | cpe:2.3:a:gnu:glibc:2.3.2:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2 | cpe:2.3:a:mit:kerberos_5:1.2:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.1 | cpe:2.3:a:mit:kerberos_5:1.2.1:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.2 | cpe:2.3:a:mit:kerberos_5:1.2.2:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.3 | cpe:2.3:a:mit:kerberos_5:1.2.3:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.4 | cpe:2.3:a:mit:kerberos_5:1.2.4:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.5 | cpe:2.3:a:mit:kerberos_5:1.2.5:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.6 | cpe:2.3:a:mit:kerberos_5:1.2.6:*:*:*:*:*:*:* |
| mit | kerberos_5 | 1.2.7 | cpe:2.3:a:mit:kerberos_5:1.2.7:*:*:*:*:*:*:* |
| openafs | openafs | 1.0 | cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:* |
| openafs | openafs | 1.0.1 | cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:* |
| openafs | openafs | 1.0.2 | cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:* |
| openafs | openafs | 1.0.3 | cpe:2.3:a:openafs:openafs:1.0.3:*:*:*:*:*:*:* |
| openafs | openafs | 1.0.4 | cpe:2.3:a:openafs:openafs:1.0.4:*:*:*:*:*:*:* |
| openafs | openafs | 1.0.4a | cpe:2.3:a:openafs:openafs:1.0.4a:*:*:*:*:*:*:* |
| openafs | openafs | 1.1 | cpe:2.3:a:openafs:openafs:1.1:*:*:*:*:*:*:* |
| openafs | openafs | 1.1.1 | cpe:2.3:a:openafs:openafs:1.1.1:*:*:*:*:*:*:* |
| openafs | openafs | 1.1.1a | cpe:2.3:a:openafs:openafs:1.1.1a:*:*:*:*:*:*:* |
| openafs | openafs | 1.2 | cpe:2.3:a:openafs:openafs:1.2:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.1 | cpe:2.3:a:openafs:openafs:1.2.1:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.2 | cpe:2.3:a:openafs:openafs:1.2.2:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.2a | cpe:2.3:a:openafs:openafs:1.2.2a:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.2b | cpe:2.3:a:openafs:openafs:1.2.2b:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.3 | cpe:2.3:a:openafs:openafs:1.2.3:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.4 | cpe:2.3:a:openafs:openafs:1.2.4:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.5 | cpe:2.3:a:openafs:openafs:1.2.5:*:*:*:*:*:*:* |
| openafs | openafs | 1.2.6 | cpe:2.3:a:openafs:openafs:1.2.6:*:*:*:*:*:*:* |
| openafs | openafs | 1.3 | cpe:2.3:a:openafs:openafs:1.3:*:*:*:*:*:*:* |
| openafs | openafs | 1.3.1 | cpe:2.3:a:openafs:openafs:1.3.1:*:*:*:*:*:*:* |
| openafs | openafs | 1.3.2 | cpe:2.3:a:openafs:openafs:1.3.2:*:*:*:*:*:*:* |
| sgi | irix | 6.5 | cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:* |
| sgi | irix | 6.5.1 | cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:* |
| sgi | irix | 6.5.2 | cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:* |
| sgi | irix | 6.5.2f | cpe:2.3:o:sgi:irix:6.5.2f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.2m | cpe:2.3:o:sgi:irix:6.5.2m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.3 | cpe:2.3:o:sgi:irix:6.5.3:*:*:*:*:*:*:* |
| sgi | irix | 6.5.3f | cpe:2.3:o:sgi:irix:6.5.3f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.3m | cpe:2.3:o:sgi:irix:6.5.3m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.4 | cpe:2.3:o:sgi:irix:6.5.4:*:*:*:*:*:*:* |
| sgi | irix | 6.5.4f | cpe:2.3:o:sgi:irix:6.5.4f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.4m | cpe:2.3:o:sgi:irix:6.5.4m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.5 | cpe:2.3:o:sgi:irix:6.5.5:*:*:*:*:*:*:* |
| sgi | irix | 6.5.5f | cpe:2.3:o:sgi:irix:6.5.5f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.5m | cpe:2.3:o:sgi:irix:6.5.5m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.6 | cpe:2.3:o:sgi:irix:6.5.6:*:*:*:*:*:*:* |
| sgi | irix | 6.5.6f | cpe:2.3:o:sgi:irix:6.5.6f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.6m | cpe:2.3:o:sgi:irix:6.5.6m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.7 | cpe:2.3:o:sgi:irix:6.5.7:*:*:*:*:*:*:* |
| sgi | irix | 6.5.7f | cpe:2.3:o:sgi:irix:6.5.7f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.7m | cpe:2.3:o:sgi:irix:6.5.7m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.8 | cpe:2.3:o:sgi:irix:6.5.8:*:*:*:*:*:*:* |
| sgi | irix | 6.5.8f | cpe:2.3:o:sgi:irix:6.5.8f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.8m | cpe:2.3:o:sgi:irix:6.5.8m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.9 | cpe:2.3:o:sgi:irix:6.5.9:*:*:*:*:*:*:* |
| sgi | irix | 6.5.9f | cpe:2.3:o:sgi:irix:6.5.9f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.9m | cpe:2.3:o:sgi:irix:6.5.9m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.10 | cpe:2.3:o:sgi:irix:6.5.10:*:*:*:*:*:*:* |
| sgi | irix | 6.5.10f | cpe:2.3:o:sgi:irix:6.5.10f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.10m | cpe:2.3:o:sgi:irix:6.5.10m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.11 | cpe:2.3:o:sgi:irix:6.5.11:*:*:*:*:*:*:* |
| sgi | irix | 6.5.11f | cpe:2.3:o:sgi:irix:6.5.11f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.11m | cpe:2.3:o:sgi:irix:6.5.11m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.12 | cpe:2.3:o:sgi:irix:6.5.12:*:*:*:*:*:*:* |
| sgi | irix | 6.5.12f | cpe:2.3:o:sgi:irix:6.5.12f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.12m | cpe:2.3:o:sgi:irix:6.5.12m:*:*:*:*:*:*:* |
| sgi | irix | 6.5.13 | cpe:2.3:o:sgi:irix:6.5.13:*:*:*:*:*:*:* |
| sgi | irix | 6.5.13f | cpe:2.3:o:sgi:irix:6.5.13f:*:*:*:*:*:*:* |
| sgi | irix | 6.5.13m | cpe:2.3:o:sgi:irix:6.5.13m:*:*:*:*:*:*:* |