A heap out‑of‑bounds read occurs in the smb2_decode_file_all_info routine of libsmb2 when it processes a FileAllInformation reply containing an unchecked FileNameLength. The vulnerability allows a malicious SMB server to send a crafted reply to smb2_stat or smb2_fstat calls, causing the client to read memory beyond the intended heap buffer and crash. The crash results in a denial of service of the client or application using the library.

The flaw exists in the public open-source library libsmb2, maintained by Sahlberg, in all releases up to and including version 6.2. Any system that links against this vulnerable library and performs smb2_stat or smb2_fstat operations against an SMB server is potentially affected.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. The EPSS score is 0.00448 (below 1%), indicating a low probability of exploitation. The flaw can be exploited remotely by any SMB server or by a man‑in‑the‑middle attacker on unsigned SMB sessions. Because the issue leads only to a crash and not data exfiltration or code execution, the primary risk is availability loss. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been disclosed, though the attack is straightforward for anyone controlling the SMB server.