CVE-2026-115505 Details

A vulnerability exists in libsmb2 versions prior to 6.3, specifically within the DCE/RPC NDR decoder in lib/dcerpc.c. This vulnerability arises from integer overflow issues that can be exploited by a malicious SMB server or a man-in-the-middle on unsigned connections. When clients invoke smb2_share_enum_async(), crafted NetrShareEnum replies can be sent with wrapping actual_count or max_count values, leading to heap out-of-bounds reads and writes. The vulnerability allows for memory corruption, with the potential for a denial-of-service condition as the client crashes while processing the erroneous server response.

Users can update to libsmb2 version 6.3, which addresses the vulnerability by fixing the integer overflow issues in the NDR decoder. The 6.3 release notes indicate that this version is a drop-in update that resolves crashes and memory errors caused by hostile server replies.