CVE-2026-110713: libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies with missing or oversized name lengths to crash the client.
Affected Software
Event History
Frequently Asked Questions
Which client connections are exposed to this issue?
Clients using libsmb2 through 6.2 are exposed when they process crafted QUERY_INFO replies from a malicious SMB server. Sessions that are unsigned can also be exposed to an attacker able to intercept and modify the SMB traffic.
What must an attacker do to trigger the vulnerability?
The attacker must cause the client to receive a crafted SMB QUERY_INFO reply targeting the file system volume or attribute information decoders. The reply uses missing or oversized name-length values so the client reads beyond the reply buffer.
What is the practical impact of successful exploitation?
The described impact is a client crash caused by a heap out-of-bounds read. The provided information does not describe confidentiality or integrity impact.