CVE-2026-110713 in libsmb2
Summary
by MITRE • 10/15/2026
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in libsmb2 versions through 6.2 represents a critical security flaw within the Server Message Block version 2 protocol implementation, specifically affecting how file system information is decoded during client-side processing. This heap-based out-of-bounds read occurs primarily within two distinct functions: smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info. These components are responsible for parsing metadata responses from SMB servers to provide clients with details about storage volumes and file attributes, respectively. The core technical deficiency lies in the insufficient validation of input data lengths before memory access operations are performed. When a client receives a QUERY_INFO reply from an SMB server, it relies on specific fields within that response to determine how much data to read into allocated heap buffers. In this flawed implementation, if the name length field is either missing entirely or specified as larger than the actual buffer size provided by the server, the decoding logic fails to perform adequate bounds checking. Consequently, the application proceeds to read memory addresses beyond the boundaries of the intended reply buffer, accessing uninitialized or unrelated data in adjacent heap regions.
From an operational perspective, this vulnerability allows for significant disruption and potential information disclosure depending on the specific memory layout at runtime. An attacker who controls a malicious SMB server or is positioned to intercept unsigned sessions can exploit this flaw by crafting specially designed QUERY_INFO replies that trigger the out-of-bounds read condition. The immediate impact of such exploitation is often a denial of service, manifested as a crash in the client application due to an access violation when attempting to process invalid memory addresses. However, beyond simple crashes, heap over-reads can potentially leak sensitive information stored in adjacent memory locations, including authentication tokens, private keys, or other confidential data processed by the SMB client during active sessions. This capability transforms what might otherwise be a stability issue into a serious confidentiality and integrity risk, particularly in enterprise environments where persistent connections to file shares are common.
The attack vector aligns with several established cybersecurity frameworks that categorize this type of flaw. It is classified under CWE-125, which denotes Out-of-bounds Read, indicating the fundamental nature of accessing memory beyond allocated limits. Furthermore, because the vulnerability can be triggered remotely by a malicious server without requiring user interaction or authentication in many configurations, it falls under MITRE ATT&CK techniques related to Remote Services exploitation and potentially Data from Information Repositories if sensitive data is exfiltrated through the leaked heap contents. The lack of proper input validation on network-received data highlights a common pattern where protocol parsers assume well-formed inputs rather than rigorously verifying structural integrity before processing.
Mitigation strategies for this vulnerability focus primarily on software updates and architectural hardening. Users running libsmb2 versions up to 6.2 should immediately upgrade to the patched version that includes corrected bounds checking logic within the smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info functions. Until an update is applied, organizations can mitigate risk by enforcing strict network segmentation policies that prevent untrusted or potentially compromised SMB servers from communicating with critical client systems. Additionally, configuring clients to require signed sessions for all file share operations reduces the attack surface, as this vulnerability specifically targets unsigned sessions where integrity checks are not enforced at the transport layer. Implementing deep packet inspection solutions capable of detecting anomalous SMB protocol structures can also provide an additional layer of defense against crafted QUERY_INFO replies designed to exploit this heap overflow condition.