EUVD-2026-101135
GHSA-r4h5-4wv2-c8cj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure client to malicious SMB server or MITM unsigned session
-
ExploitClient issues smb2_stat/smb2_fstat query
-
ExecutionServer returns crafted FileAllInformation with oversized FileNameLength
-
ImpactHeap out-of-bounds read crashes the client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control the SMB server the libsmb2 client connects to, OR to perform a man-in-the-middle on an SMB session that is NOT signed (SMB signing mitigates the MITM path). The vulnerable client must additionally invoke smb2_stat or smb2_fstat so that the server-supplied FileAllInformation reply is parsed by smb2_decode_file_all_info with an unchecked FileNameLength at offset 96. Limiting factors: the victim is the client (not a listening service), passive user interaction is needed to initiate the connection (UI:P), and the impact is confined to a crash of the client process - there is no privilege requirement (PR:N) but also no code execution or data exposure. |
| Impact | This is a genuine but bounded issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly scopes impact to availability only - VC:N and VI:N confirm there is no confidentiality or integrity loss, so despite the 7.1 'High' score this is a client-side denial-of-service (crash), not RCE or data theft. A publicly available exploit/write-up exists (hackmd PoC), which raises the practical likelihood of opportunistic abuse, but the CVE is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - treat PoC availability and active exploitation as distinct signals. The attack is unauthenticated (PR:N) and network-reachable, but it is inverted from typical server-side flaws: the VICTIM is the SMB client, and the attacker must either operate a malicious SMB server the client connects to or perform a man-in-the-middle on an unsigned session, plus the client must actually issue a stat/fstat call (UI:P). Net: prioritize patching for environments where libsmb2 clients connect to untrusted servers or run over unsigned SMB, but this is a crash/availability bug, not a critical compromise vector. One signal tension worth noting: a 'Information Disclosure' tag is present, yet the CVSS (VC:N) and the description (only 'crash the client') indicate no data disclosure - verify impact scope with the VulnCheck advisory before classifying this as an info-leak. |
| Exploit ScenarioDerived | A user running an application built on libsmb2 (≤6.2) connects to an attacker-controlled SMB server, or an attacker on-path MITMs an unsigned SMB session. When the client performs a smb2_stat/smb2_fstat, the server returns a crafted FileAllInformation reply with an oversized FileNameLength, triggering a heap out-of-bounds read in smb2_decode_file_all_info and crashing the client. A public PoC/write-up demonstrating the OOB read exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - this is addressed by commit 57bee9fb941a39307145b82e4dd1718862f30a74 in https://github.com/sahlberg/libsmb2, which adds a return-value check on smb2_get_uint32 and clamps FileNameLength to vec->len - 100; integrators should update to a libsmb2 release that contains this commit and confirm the shipped version with the vendor before assuming coverage. Where upgrading is not immediately possible, the practical compensating controls are: enforce SMB signing on all sessions so the man-in-the-middle variant of the attack is blocked (note this does not mitigate a client that is deliberately pointed at a malicious server), and restrict libsmb2-based clients to connect only to explicitly trusted, known SMB servers or to authenticated shares rather than arbitrary user-supplied hosts - this removes the untrusted-server vector but is operationally restrictive. Additionally, applications that do not require metadata queries can reduce exposure by avoiding smb2_stat/smb2_fstat against untrusted endpoints where the feature set allows it; this narrows but does not fully eliminate the attack surface, since other query-info paths may still reach the same parser. Patch references and the coordinator advisory are at https://github.com/sahlberg/libsmb2/commit/57bee9fb941a39307145b82e4dd1718862f30a74 and https://www.vulncheck.com/advisories/libsmb2-through-6.2-heap-out-of-bounds-read-via-smb2-decode-file-all-info.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsmb2 is a client-side SMB2/SMB3 protocol library used by applications that need to talk to SMB/CIFS file shares. The vulnerability is a classic CWE-125 out-of-bounds read in the SMB2 query-info reply parser: smb2_decode_file_all_info() reads a fixed-offset field (FileNameLength / name_len at offset 96 of the FileAllInformation structure) directly from the server-supplied response buffer via smb2_get_uint32(), whose return value was originally ignored, and then uses that attacker-controlled length to bound a subsequent read of the UTF-16 FileName. Because the length is never validated against the actual size of the received buffer (vec->len), a short or malformed reply from a hostile server causes the parser to read past the end of a heap allocation. The CPE cpe:2.3:a:sahlberg:libsmb2:*:*:*:*:*:*:*:* indicates all versions of the sahlberg libsmb2 library up to and including 6.2 are in scope. The upstream commit 57bee9fb941a39307145b82e4dd1718862f30a74 fixes this by checking the return status of smb2_get_uint32(vec, 96, &name_len) and by clamping name_len to vec->len - 100, truncating the name length when the server supplies a short reply instead of reading beyond the buffer.
Know when Libsmb2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable client attack needing no auth (PR:N) but requiring the victim to connect/query a malicious or MITM'd server (UI:R); impact is crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.
Executive ViewAI
libsmb2, a client-side SMB library used in various applications, contains a high-severity heap out-of-bounds read vulnerability (CVE-2026-110712) that allows a malicious SMB server to crash connecting clients, impacting availability. Although exploitation requires a user to connect to a malicious server, publicly available exploit code exists and unauthenticated attackers can trigger the crash. Organizations relying on affected libsmb2 versions should prioritize patching to prevent disruption to file-sharing operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that tr
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by
Exploit-DB