CVE-2026-110712

The libsmb2 library (versions through 6.2 ) contains a heap out-of-bounds read vulnerability within the smb2_decode_file_all_info function. The root cause is an unchecked FileNameLength parameter. A malicious SMB server or an attacker performing a man-in-the-middle attack on unsigned sessions can...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

EUVD-2026-101135

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712: Out-of-bounds Read

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110714: Integer Underflow (Wrap or Wraparound)

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

PT-2026-114114

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2 decode file all info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

PT-2026-114115

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2 decode file fs volume info and smb2 decode file fs attribute info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY INFO...

CVE-2026-110713: Out-of-bounds Read

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

PT-2026-114116

Name of the Vulnerable Software and Affected Versions libsmb2 versions prior to 6.2 Description An integer underflow exists in the decode acl function. This allows malicious SMB servers or attackers intercepting unsigned sessions to trigger heap out-of-bounds reads by sending a crafted security...

CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

UBUNTU-CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

CVE-2025-57632: Buffer Copy without Checking Size of Input

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

PT-2025-39452

Name of the Vulnerable Software and Affected Versions libsmb2 versions 6.2 and later Description The software contains a flaw due to improper handling of SMB2 chained PDUs NextCommand. Specifically, the smb2 add iovector function is repeatedly called to append to a fixed-size iovec array without...

libsmb2 security vulnerability

libsmb2 is an SMB client from the individual developer Ronnie Sahlberg. A security vulnerability exists in libsmb2 version 6.2, which stems from a failure to check the v-niov limit when processing SMB2 linked PDUs, which could lead to heap out-of-bounds writes and memory corruption, which in turn...