Libsmb2
Monthly
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.