libsmb2 contains a heap out‑of‑bounds read in the functions smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info. A malicious SMB server or an attacker intercepting unsigned SMB sessions can send crafted QUERY_INFO replies with missing or oversized name lengths, causing the client to read past its reply buffers. This read vulnerability can expose arbitrary memory contents to the attacker, leading to information disclosure. The weakness is formalized as CWE‑125.

The vulnerability affects the libsmb2 library supplied by sahlberg up to and including version 6.2. Any project or system that links against libsmb2 6.2 or earlier may be able to process malicious SMB replies.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS is 0.00467 and the issue is not listed in CISA KEV, but the requirement of an SMB server under the attacker's control or the ability to intercept unsigned SMB sessions reduces the attack surface to trusted networks. Attackers could exploit the flaw by crafting a specific QUERY_INFO reply that triggers a heap out‑of‑bounds read, potentially leaking sensitive data. Defenses that enforce signed SMB sessions or restrict SMB traffic to trusted hosts mitigate the risk.