libsmb2 contains an integer underflow (CWE‑191) in its decode_acl function that allows a malicious SMB server or an attacker intercepting unsigned SMB sessions to send a QUERY_INFO reply with an AclSize field smaller than eight. The underflow bypasses access control list bounds checks, enabling the client to read beyond its heap buffer. The resulting out‑of‑bounds read causes the client to crash, leading to a denial of service.

The affected product is the libsmb2 networking library developed by sahlberg. Versions up to and including 6.2 incorporate the vulnerable decode_acl implementation. Any build of libsmb2 that is linked into client applications that process SMB QUERY_INFO replies is at risk.

Risk assessment: The vulnerability has a CVSS score of 7.1, indicating a high-impact flaw. The EPSS score of < 1% suggests that exploitation is currently unlikely but not impossible, particularly for attackers who control an SMB server or can intercept traffic on unsigned sessions. The flaw is not listed in CISA's KEV catalog. Attackers can trigger the denial of service by sending a malicious SMB QUERY_INFO reply with an AclSize field below eight, which triggers a heap out‑of‑bounds read and causes the client to crash. Because the vulnerable code path operates in user mode and the flaw does not provide code execution or privilege escalation, the threat remains confined to service disruption.