CVE-2026-110713 Details
Description
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
A heap out-of-bounds read vulnerability has been identified in libsmb2 versions through 6.2. This vulnerability resides in the SMB2 reply decoders for file system information, specifically in the 'smb2_decode_file_fs_volume_info' and 'smb2_decode_file_fs_attribute_info' functions. The issue allows malicious SMB servers to craft QUERY_INFO replies with manipulated name lengths, leading the client to read beyond the intended buffer limits. This vulnerability can be exploited by servers controlled by an attacker or by intercepting unsigned SMB sessions.
The vulnerability has been addressed in libsmb2 version 6.2. Users are advised to update to this version or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libsmb2 | <= 6.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |