Description
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.
Published: 2026-10-22
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an integer overflow in the DCE/RPC NDR decoder of libsmb2, which can be triggered by crafted NetrShareEnum replies. The overflow enables heap out‑of‑bounds reads and writes, allowing an attacker to corrupt memory and potentially execute arbitrary code on the client machine.

Affected Systems

The affected product is the libsmb2 library, developed by Sahlberg. All releases prior to version 6.3 contain the flaw; upgrading to 6.3 or later removes the vulnerability.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity condition. The likely attack vector is network‑based, allowing a malicious or compromised SMB server or a man‑in‑the‑middle on unsigned SMB connections to send crafted NetrShareEnum replies, triggering the overflow. EPSS score is not available and the flaw is not listed in the CISA KEV catalog, but the exposure to remote actors makes exploitation plausible.

Generated by OpenCVE AI on October 23, 2026 at 03:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to libsmb2 version 6.3 or later to eliminate the overflow flaw.
  • If an immediate upgrade is impossible, restrict SMB traffic to signed connections or limit exposure of SMB services to trusted networks only.
  • As a temporary measure, review and apply the patch committed in the lib/dcerpc.c repository (commit a79f6914) or isolate vulnerable systems from untrusted networks.

Generated by OpenCVE AI on October 23, 2026 at 03:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.
Title libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T19:14:05.297Z

Reserved: 2026-10-22T16:14:59.116Z

Link: CVE-2026-115505

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T20:17:06.470

Modified: 2026-10-22T20:17:06.470

Link: CVE-2026-115505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:00:12Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound