CVE-2026-111137: libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL
libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use affected libsmi versions to process attacker-controlled or otherwise untrusted MIB files are exposed. The issue can crash smidump or other consumers of the library.
What must an attacker provide to trigger the flaw?
The attacker needs to cause the application to process a crafted MIB containing an OCTET STRING DEFVAL of at least 512 octets whose first byte is 0x00. Exploitation requires user interaction according to the supplied vector.
What is the likely impact?
The crafted value can overflow libsmi's fixed 1024-byte static buffer during hexadecimal rendering, corrupting adjacent library globals. The reported consequence includes application crashes and a high availability impact.