CVE-2009-1251: Openafs

High severity, CVSS 10.0. EPSS: 6.4% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.

Affected products

• Openafs Openafs: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.4a only; …
• Unix Unix: any version

Published 2009-04-09. Last modified 2026-06-16.