CVE-2026-64816

RapidRAW before 1.6.0 fails to validate lutPath in preset files before File::open() in lut_processing.rs. On Windows, a UNC path in lutPath can trigger an outbound SMB connection to an attacker-controlled host, leaking NTLMv2 credentials. The vulnerability is reachable via two vectors: (1) commun...

CVE-2026-64381

A flaw was found in the SMB client of the Linux kernel. A remote attacker could exploit a memory leak in the receiveencryptedstandard function by sending specially crafted compound Protocol Data Units PDUs. This vulnerability occurs because a buffer is allocated before a necessary size check,...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...

CVE-2026-64388

A flaw was found in the Linux kernel's Server Message Block SMB client. When mounting filesystems using SMB3 POSIX Extensions, modifications to file ownership chown and group chgrp were not correctly applied on the server unless specific mount options were also enabled. This could allow a local...

CVE-2026-64380

A flaw was found in the Linux kernel's Server Message Block SMB client. The vulnerability exists in the posixinfosidsize function, which is responsible for parsing POSIX Security Identifiers SIDs. An insufficient boundary check allows the system to accept truncated POSIX SIDs, which could lead to...

CVE-2026-64383

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

CVE-2026-64379

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing server-provided file mode information, the system incorrectly applies these modes without proper security masking. This can result in unintended file permissions, potentially allowing unauthorized access to...

CVE-2026-64257

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could exploit a vulnerability where the client improperly handles SMB2 responses containing overlapping data areas. This incorrect processing of malformed network data could lead to a denial of service DoS o...

CVE-2026-64401

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a use-after-free, occurs when handling witness registrations. Specifically, a second mount for the same network share can cause the system to incorrectly reference a previously freed connection, leading to...

CVE-2026-64382

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...

CVE-2026-64448

A flaw was found in the Linux kernel's Server Message Block SMB client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read beyond the intended memory buffer, potentially leading to the...

CVE-2026-57211

A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, rabbitmgmtwmstatic, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to...

CVE-2026-39873

CVE-2026-39873 affects macOS where an issue with memory handling during SMB server interactions could cause system termination. The vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Connected advisories describe this as part of broader memory-management fi...

CVE-2026-39873

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB server may lead to unexpected system termination...

GO-2026-5051 Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2

ReadDir and ReadDirPlus parse the QUERYDIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int...

CVE-2026-64384

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2notifyinit fails, the same buffer can be freed agai...

CVE-2026-64437

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an authenticated client using the Server Message Block SMB protocol to trigger a use-after-free error. By sending specific close and cancel requests, an attacker can cause the kernel to crash, leading to a deni...

CVE-2026-64393

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a local attacker to escalate privileges by manipulating Server Message Block SMB2 SETINFO operations. The system incorrectly uses the ksmbd worker's credentials instead of the original user's credentials when...

CVE-2026-64398

A flaw was found in the Linux kernel's ksmbd component. An authenticated Server Message Block SMB client with only FILEWRITEATTRIBUTES permission can bypass a security check in the FSCTLSETZERODATA function. This allows the client to zero out file data, leading to data destruction and a denial of...

CVE-2026-64397

A flaw was found in the Linux kernel's ksmbd kernel Server Message Block daemon component. Concurrent directory query requests using the same file handle can lead to a stack use-after-free vulnerability. This occurs because smb2querydir stores a pointer to stack-allocated data that can be...