CVE-2026-56719: MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
MikroTik RouterOS versions earlier than 7.24 are affected if their userspace SMB daemon is reachable by an attacker over the network. The issue is in SMB1 SessionSetupAndX request handling.
Does exploitation require SMB credentials or user interaction?
No. The vulnerable handler processes the crafted request before credential validation, so an unauthenticated attacker does not need valid SMB credentials or user interaction.
What could an attacker gain from successful exploitation?
A crafted uniPwdLen value can cause the SMB daemon to read past the end of the request buffer, potentially exposing sensitive contents from memory. The provided information does not indicate code execution or data modification.
What is the available remediation?
Upgrade RouterOS to version 7.24 or later. If upgrading cannot happen immediately, limiting network access to the SMB service reduces exposure, although the provided information does not specify a product-specific workaround.