CVE-2026-110714: libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply, bypassing ACE bounds checks and crashing the client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to a network attacker?
Clients using affected libsmb2 versions are exposed when they connect to an attacker-controlled SMB server. Clients using unsigned SMB sessions may also be exposed to an on-path attacker that can intercept and modify session traffic.
Does exploitation require credentials on the client or SMB server?
No privileges are required according to the supplied vector. The attacker needs to provide a crafted QUERY_INFO reply containing a security descriptor with an AclSize below 8.
What is the likely impact of a successful exploit?
The crafted reply causes a heap out-of-bounds read by bypassing ACE bounds checks, which can crash the client. The provided impact assessment indicates availability impact, with no stated confidentiality or integrity impact.