CVE-2026-115505: libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actualcount or maxcount values when clients call smb2shareenumasync(), corrupting heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using libsmb2 before 6.3 are exposed when they call smb2_share_enum_async() against a malicious SMB server. Clients using unsigned SMB connections can also be exposed to a machine-in-the-middle that can alter server replies.
What does exploitation require?
An attacker needs to provide or modify a NetrShareEnum response containing crafted wrapping actual_count or max_count values. The CVSS vector indicates no privileges are required, but user interaction is required.
What can happen if exploitation succeeds?
The crafted reply can trigger heap out-of-bounds reads and writes through integer overflow in the DCE/RPC NDR decoder, resulting in heap-memory corruption. The stated impacts include low confidentiality and integrity impact and high availability impact.
What should be done if an immediate upgrade is not possible?
Avoid calling smb2_share_enum_async() against untrusted SMB servers, and avoid unsigned SMB connections where a machine-in-the-middle could modify replies. Upgrade libsmb2 to version 6.3 or later when possible.