libsmi CVE-2026-111137

Requires that a libsmi-based consumer (smidump or any program linking libsmi) parses an attacker-controlled MIB file whose OCTET STRING DEFVAL is 512 or more octets and begins with a 0x00 byte - the specific input that drives smiValueAsString() hex rendering past the fixed 1024-byte static buffer. Exploitation is LIMITED by its local nature and the required user/pipeline action of loading the malicious MIB (UI:P): there is no remote network trigger, and environments that never process untrusted or externally sourced MIBs are not exposed. No authentication is modeled (PR:N), but the victim must actively feed the crafted file to a vulnerable consumer.

This is a genuine but moderate-priority memory-corruption bug, not a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, score 6.9 Medium) is internally consistent with the description: exploitation is LOCAL and requires a victim to process an attacker-supplied MIB file (UI:P), the dominant impact is availability (VA:H - a crash of smidump or any libsmi consumer), with only limited integrity (VI:L, from corruption of adjacent library globals) and no confidentiality loss (VC:N). Publicly available exploit code exists (POC via hackmd write-up) and the report comes from a credible source (VulnCheck), which raises practical likelihood. However, the CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - this is POC-stage, not weaponized. The signals are coherent rather than conflicting: a local, interaction-dependent crash primitive in a parsing library. Because the vulnerable function writes past a fixed 1024-byte static buffer and corrupts adjacent globals (CWE-787), code execution cannot be fully excluded, but the description and author/vendor framing describe corruption-and-crash rather than confirmed RCE; treat memory-safety escalation as plausible-but-unproven. Net: patch in normal cycles and prioritize where libsmi parses untrusted MIBs, but it does not warrant emergency response absent KEV/active-exploitation evidence.

An attacker distributes or submits a malicious MIB file containing an OCTET STRING DEFVAL of 512 or more octets with a leading 0x00 byte; when an analyst or automated pipeline runs smidump (or another libsmi-based consumer) against that MIB, smiValueAsString() hex-renders the value and overflows the fixed 1024-byte static buffer, corrupting adjacent library globals and crashing the process. A public proof-of-concept write-up exists, lowering the barrier to reproduction. Because the attack vector is local and requires the victim to process the file (UI:P), exploitation hinges on getting a crafted MIB into a parsing workflow.