CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs NextCommand, libsmb2 repeatedly calls smb2addiovector to append to a fixed-size iovec array without checking the upper bound of v-niov SMB2MAXVECTORS=256. An attacker can craft responses with many chained PDUs to...

CVE-2025-1048: Use After Free

Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw...

PT-2025-15877 · Sonos +1 · Sonos Era 300 Speaker +1

Name of the Vulnerable Software and Affected Versions: Sonos Era 300 Speaker affected versions not specified Description: The issue is related to a Use-After-Free Remote Code Execution Vulnerability in the libsmb2 component. This vulnerability was discovered by dungdm @ piers2 with Viettel Cyber...

(Pwn2Own) Sonos One Speaker libsmb2 Integer Overflow Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results...

(Pwn2Own) Sonos One Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results from th...