CVE-2026-110712: libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2stat or smb2fstat calls, crashing the client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using libsmb2 through version 6.2 are exposed when they call smb2_stat or smb2_fstat against an SMB server that can send crafted FileAllInformation replies.
What does an attacker need to exploit it?
The attacker must control the SMB server, or be able to perform a man-in-the-middle attack against an unsigned SMB session. No client privileges are required, but a user must interact with the malicious or intercepted SMB service.
What is the practical impact?
A crafted unchecked FileNameLength can trigger a heap out-of-bounds read and crash the libsmb2 client. The provided information describes an availability impact only.