EUVD-2026-101136
GHSA-w2j6-hg6c-f9mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure client to malicious SMB server
-
DeliveryClient sends QUERY_INFO request
-
ExploitServer returns crafted FS-info reply with bad name length
-
ExecutionDecoder reads past reply buffer (OOB read)
-
ImpactClient process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the libsmb2 client (version through 6.2) to process a QUERY_INFO reply from an endpoint the attacker controls - either a fully attacker-operated SMB server the victim connects to, or a man-in-the-middle position on an UNSIGNED SMB session. The crafted reply must target the FileFsVolumeInformation path (smb2_decode_file_fs_volume_info) with an oversized volume_label_length, or the FileFsAttributeInformation path (smb2_decode_file_fs_attribute_info) with an oversized/missing name_len, exceeding the received reply buffer. Limiting factors: the victim client must initiate the connection and issue a filesystem-info query (UI:P), so there is no unsolicited server-to-client trigger; enabling SMB signing defeats the MITM/unsigned-session path; and the impact is confined to a client crash (no confirmed confidentiality or integrity effect per VC:N/VI:N). |
| Impact | This is a client-side availability flaw, not a critical remote-code-execution priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) is internally consistent with the description: the only impact metric set is VA:H (availability), while VC and VI are N - meaning despite the 'Information Disclosure' tag and the OOB-read primitive (CWE-125), the realistic outcome is a client crash (denial of service), not confirmed data exfiltration. The network attack vector is real but conditional: it requires UI:P (the victim's libsmb2 client must connect to or be redirected to a hostile endpoint), so this is not a wormable, zero-interaction bug. A public write-up/POC exists (hackmd) and a vendor patch is available, which raises the operational priority for anyone shipping libsmb2, but no EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Signal summary: moderate CVSS, POC present, patch present, no KEV, no EPSS - this is a 'patch on a normal cadence' issue rather than an emergency. Note one tension to verify: the 'Information Disclosure' tag overstates impact relative to the vendor's VC:N rating; treat this as a DoS until a disclosure POC is demonstrated. |
| Exploit ScenarioDerived | A victim application using libsmb2 (<=6.2) connects to an SMB share that is attacker-controlled, or an attacker on-path intercepts an unsigned SMB session. The malicious server answers a QUERY_INFO request with a crafted FileFsVolumeInformation or FileFsAttributeInformation reply carrying a missing or oversized name/label length, causing the decoder to read past the received reply buffer and crash the client. A public proof-of-concept write-up exists, and because AC:L the crafted reply is straightforward to construct, though UI:P means the victim must first initiate the connection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.
RemediationAI
Apply the upstream fix, which is the commit https://github.com/sahlberg/libsmb2/commit/dd0bbdee24bb56f7ec95431afc07ce0a666533f7 adding the missing length validation in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info; the vendor reports a patch as available, though the released patched version number is not independently confirmed here, so rebuild and re-vendor against this commit (or a later tagged release containing it) rather than relying on a version string. Because the vulnerable path is only reachable on an unsolicited reply from a server the client talks to, the strongest compensating control is to enable SMB signing (and require it where the peer supports it), which defeats the man-in-the-middle/unsigned-session variant of the attack - at the cost of added signing overhead and possible interoperability problems with peers that do not negotiate signing. Where signing cannot be enabled, restrict libsmb2 clients to trusted SMB servers reachable only over segmented or VPN-protected networks and block outbound SMB (TCP 445/139) to untrusted hosts, accepting that this limits legitimate share access. There is no supported configuration switch that disables the filesystem-information queries themselves without losing volume/attribute metadata, so patching remains the only complete fix; note that SMB signing does not protect against a client that deliberately connects to an attacker-operated server.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsmb2 is a client-side SMB2/3 library used to mount and browse SMB shares from non-Windows platforms. The flaw is a classic CWE-125 out-of-bounds read in two reply decoders: smb2_decode_file_fs_volume_info (lib/smb2-data-filesystem-info.c) parses the FileFsVolumeInformation reply, whose fixed 18-byte header is followed by a variable-length volume label, and smb2_decode_file_fs_attribute_info parses the FileFsAttributeInformation reply, whose fixed 12-byte header is followed by a variable-length filesystem name. In both cases the length field (volume_label_length or name_len) is taken directly from the network reply and was not validated against the actual size of the received buffer before the decoder advanced past it. A malicious server can therefore declare a label or name that runs beyond the end of the reply, causing the decoder to read out of bounds on the heap. The upstream fix adds explicit bounds checks - rejecting replies shorter than the 18-byte (volume info) or 12-byte (attribute info) fixed header, and rejecting any reply where the attacker-supplied length exceeds the remaining buffer - which converts the unsafe read into a clean parse failure. The affected component is tracked as cpe:2.3:a:sahlberg:libsmb2:*:*:*:*:*:*:*:*, covering all releases through 6.2.
Know when Libsmb2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Client must connect to a hostile server so UI:R and PR:N; crafted reply is simple (AC:L); impact is a crash only, so C:N/I:N/A:H with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
Executive ViewAI
libsmb2 through 6.2 contains a heap out-of-bounds read that can crash SMB client applications when they connect to a malicious or man-in-the-middle SMB server, creating a targeted availability risk for users and services that depend on affected clients. Publicly available exploit code exists, but there is no confirmed active exploitation and the flaw has not been shown to expose or alter data. Leadership should prioritize remediation because affected clients are broadly embeddable, exploitation requires a victim to initiate an SMB connection to an untrusted endpoint, and the vendor has released a fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that tr
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB
Exploit-DB