CVE-2026-110714: Integer Underflow (Wrap or Wraparound) in sahlberg libsmb2

CVE-2026-110714 is an integer underflow vulnerability in libsmb2 through version 6.2, specifically in the decode_acl function. A malicious SMB server or an attacker intercepting unsigned sessions can send a QUERY_INFO reply with an AclSize field less than 8, bypassing Access Control Entry (ACE) bounds checks. This triggers heap out-of-bounds reads on the client side, potentially causing crashes. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows attackers controlling an SMB server or intercepting unsigned sessions to cause heap out-of-bounds reads on the client, leading to application crashes. This impacts client stability and could be leveraged for denial-of-service conditions. There is no indication of code execution or data disclosure from the provided data.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted SMB servers and consider disabling unsigned SMB sessions where possible to reduce exposure.