EUVD-2026-101137
GHSA-f7hf-m5cf-j6wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure libsmb2 client to malicious SMB server (or MITM unsigned session)
-
ExploitReturn QUERY_INFO reply with AclSize below 8
-
ExecutionInteger underflow bypasses ACE bounds check in decode_acl
-
ImpactHeap out-of-bounds read crashes client (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | The attacker must either control the SMB server the victim's libsmb2 client connects to, or hold a man-in-the-middle position on an UNSIGNED SMB session (SMB signing would block MITM injection). The concrete trigger is a QUERY_INFO reply carrying a security descriptor whose ACL AclSize field is set below 8 bytes, which underflows the remaining-length counter and defeats the per-ACE bounds check in decode_acl. Limiting factors: exploitation is client-side and passive on the attacker's part - it depends on the victim initiating a connection to the hostile server (UI:P) or on MITM of a non-signed session - and the impact is confined to a client crash (no code execution, no data disclosure, no integrity loss). |
| Impact | This is a moderate-priority, availability-only flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) yields 7.1 driven ENTIRELY by availability impact (VA:H) - there is no confidentiality or integrity impact, so this is a denial-of-service (client crash via heap out-of-bounds read), not remote code execution. The network vector and PR:N are counterbalanced by UI:P: the attack is not server-side or self-propagating - it requires the victim's client to connect to an attacker-controlled SMB server, or the attacker to occupy a man-in-the-middle position on an unsigned SMB session. Public exploit code exists (a hackmd technical write-up plus the VulnCheck advisory), which raises practical likelihood, but there is NO CISA KEV listing and NO EPSS score in the provided data, so widespread or automated exploitation cannot be inferred. Net: a legitimate client-side DoS worth patching in SMB-client deployments, but not a drop-everything network-wormable issue - the DoS-only impact and the requirement for client-initiated connection or MITM meaningfully limit real-world risk below what the 7.1 headline suggests. |
| Exploit ScenarioDerived | An attacker stands up a malicious SMB server (or intercepts an unsigned SMB session via MITM) and waits for a libsmb2-based client to connect. When the client issues a QUERY_INFO request, the server returns a crafted security descriptor whose ACL declares an AclSize below 8; the subsequent integer underflow in decode_acl bypasses the ACE bounds check and drives a heap out-of-bounds read that crashes the client. Public exploit/write-up material exists (hackmd PoC and VulnCheck advisory), lowering the bar to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.
RemediationAI
Apply the vendor-supplied upstream fix commit 523abe20be3207011a936db47f1d3bab79c05450 (https://github.com/sahlberg/libsmb2/commit/523abe20be3207011a936db47f1d3bab79c05450), which adds the DEC_VLEN() length-validation macro to decode_acl/decode_ace and hardens the descriptor offset checks; note that a tagged patched release number is not independently confirmed in the available data, so consumers should either build from the fixed commit or confirm the fixed tag with the maintainers. Because the trigger arrives from the server side, the most effective compensating controls are enabling and requiring SMB signing on client sessions (this blocks the man-in-the-middle injection path, at some CPU and interoperability cost with legacy servers) and restricting libsmb2 clients to trusted, authenticated servers rather than attacker-controlled or anonymous shares. If immediate patching is not possible, avoid connecting affected clients to untrusted SMB endpoints and monitor for client crashes during QUERY_INFO/ACL retrieval as a detection signal; note that crash-only impact means these controls reduce availability risk rather than preventing a confirmed data compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsmb2 (CWE-191, Integer Underflow) is a portable SMB2/SMB3 client library used to mount and browse Windows/Samba shares; its parser in lib/smb2-data-security-descriptor.c walks the security descriptor returned by an SMB2 QUERY_INFO response. A security descriptor contains a DACL composed of a fixed 8-byte ACL header plus a sequence of variable-length ACE records, and the parser tracks remaining bytes in an smb2_iovec length field. Prior to the fix, decode_acl subtracted 8 for the ACL header (v.len -= 8) and then subtracted each ACE size without first verifying that enough bytes remained, so a server-supplied AclSize below 8 caused the unsigned length counter to wrap to a very large value; the subsequent per-ACE bounds check then passed and the code read beyond the allocated heap buffer. The vulnerability is in the CPE-identified package cpe:2.3:a:sahlberg:libsmb2 (all versions up to and including 6.2, per the advisory). The upstream fix introduces a DEC_VLEN() macro that validates v.len before every subtraction across decode_ace and decode_acl, returns a 'corrupted pdu' error instead of decoding, and additionally rewrites the offset_owner/offset_group/offset_dacl range checks in smb2_decode_security_descriptor to use subtraction-based comparisons (vec->len - offset) that cannot themselves overflow.
Know when Libsmb2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Malicious server/MITM delivers a crafted reply (AV:N, AC:L, PR:N), but the client must initiate the connection (UI:R); impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.
Executive ViewAI
libsmb2, a client library for SMB2/3, is vulnerable to a denial-of-service condition when connecting to a malicious or compromised SMB server. Successful exploitation crashes the client application, disrupting availability for users and business processes relying on SMB-connected services. While publicly available exploit code exists, the attack requires control of the SMB server or a man-in-the-middle position, limiting the scope to a moderate-priority availability risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB
Exploit-DB