debian/libsmb2 vulnerabilities

Latest debian/libsmb2 CVEs

Newest publication first

1. CVE-2026-115505 libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum

   Published 2026-10-22

   High·CVSS 7.2 EPSS 0.21%

   libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping act...

2. CVE-2026-110714 libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

   Published 2026-10-14

   High·CVSS 7.1 EPSS 0.54%

   libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a...

3. CVE-2026-110713 libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

   Published 2026-10-14

   High·CVSS 7.1 EPSS 0.46%

   libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send c...

4. CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

   Published 2026-10-14

   High·CVSS 7.1 EPSS 0.44%

   libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can r...

5. CVE-2025-57632 libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the....

   Published 2025-09-25

   High·CVSS 7.5 EPSS 0.58%

   libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses w...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.