libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

Advisories

libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

Severity: high
Date: 10/14/2026
Affecting: libsmb2 <= 6.2
CVE: CVE-2026-110714
CWE: CWE-191 Integer Underflow (Wrap or Wraparound)
CVSS: 7.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read
https://github.com/sahlberg/libsmb2/blob/d67e213a5c4e7e4969fd81f0b95e4ca5831fbba1/lib/smb2-data-security-descriptor.c#L266
https://github.com/sahlberg/libsmb2/commit/523abe20be3207011a936db47f1d3bab79c05450
https://github.com/sahlberg/libsmb2
Credit: 韓佳翰, HaiND from the Post and Telecommunication Institute of Technology
Description: libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo