CVE-2026-110712 in libsmb2
Summary
by MITRE • 10/14/2026
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in libsmb2 versions through 6.2 represents a critical heap-based out-of-bounds read flaw located within the smb2_decode_file_all_info function. This specific component is responsible for parsing FileAllInformation responses received from SMB servers during file status operations such as smb2_stat or smb2_fstat. The core technical deficiency lies in the absence of rigorous validation checks on the FileNameLength field contained within these server replies. When a client processes a crafted response, it fails to verify that the length value is consistent with the actual buffer size allocated for parsing. Consequently, if an attacker provides a FileNameLength value that exceeds the bounds of the available memory region, the decoding routine attempts to read data from unauthorized heap locations. This improper boundary check allows for arbitrary memory reads beyond the intended allocation limits, which typically results in immediate application termination or crash due to segmentation faults or access violations triggered by the operating system's memory protection mechanisms.
From an operational perspective, this vulnerability primarily facilitates Denial of Service attacks against clients utilizing libsmb2. Since the exploit requires either direct control over the SMB server being queried or a successful man-in-the-middle position on unsigned sessions, the attack vector is somewhat constrained but still significant in environments where trust boundaries are not strictly enforced. An attacker who can intercept and modify traffic for unencrypted SMB connections can inject malicious FileAllInformation replies into smb2_stat or smb2_fstat calls. Upon receiving these crafted packets, the client application will attempt to decode them using the vulnerable function, leading to a crash of the local process. This disruption affects availability by rendering file access operations impossible until the service is restarted, potentially impacting productivity and system stability in networked environments relying on SMB for file sharing or storage connectivity.
In terms of classification standards, this vulnerability aligns with CWE-125, which defines out-of-bounds read errors where software reads data past the end or before the beginning of the intended buffer. The exploitation technique corresponds to ATT&CK tactic T1499, Endpoint Denial of Service, specifically under techniques that involve resource exhaustion via application crashes. Furthermore, because it involves manipulating input fields without proper validation, it also relates to CWE-20, Improper Input Validation. The lack of bounds checking on the FileNameLength field is a classic example of insufficient sanitization before processing untrusted data from network sources.
Mitigation strategies should focus primarily on updating libsmb2 to version 6.3 or later, where this specific validation logic has been corrected to ensure that FileNameLength does not exceed buffer limits during decoding operations. For environments unable to update immediately due to dependency constraints, implementing strict firewall rules and enforcing SMB encryption for all sessions can significantly reduce the risk of exploitation by preventing man-in-the-middle attacks on unsigned traffic. Additionally, deploying network intrusion detection systems capable of identifying anomalous SMB packet structures may provide early warning indicators of attempted exploitation attempts against vulnerable clients.