CVE-2026-115505: Integer Overflow or Wraparound in sahlberg libsmb2

CVE-2026-115505 describes integer overflow or wraparound vulnerabilities in libsmb2 prior to version 6.3. The flaws exist in the DCE/RPC NDR decoder within lib/dcerpc.c, where crafted NetrShareEnum replies with wrapping actual_count or max_count values cause heap out-of-bounds reads and writes. This memory corruption occurs when clients invoke smb2_share_enum_async(), enabling a remote attacker controlling an SMB server or positioned as a man-in-the-middle on unsigned connections to exploit the vulnerability.

Successful exploitation allows a remote attacker to corrupt heap memory on the client by sending maliciously crafted NetrShareEnum responses. This can lead to potential denial of service or other memory corruption consequences. The attack requires no privileges and no user interaction but depends on unsigned SMB connections.

A fix is available in libsmb2 version 6.3 and later. Users should upgrade to version 6.3 or above to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes.