The flaw stems from improper validation of the DataOffset field within SMB responses, allowing an out‑of‑bounds memory read that can be abused to execute arbitrary code in kernel mode. Authentication is not required, so a remote attacker can trigger the vulnerability by sending crafted SMB packets, gaining remote code execution with elevated privileges and potentially compromising the device and any connected systems.

All Sonos Era 300 smart speakers run on firmware that processes SMB responses. The vulnerability exists in any current firmware version from the product’s launch until a vendor patch is applied; no specific firmware range is published.

With a CVSS base score of 9.8 the flaw is considered critical. The EPSS score is 1 %—a low yet nonzero chance of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Attackers can exploit it via network SMB traffic without authentication, delivering malicious payloads that execute in kernel space. This gives an attacker full control over the device. The weakness is identified as CWE‑119—Out‑of‑Bounds Write.