This vulnerability in Sonos Era 300 involves improper restriction of operations within the bounds of a memory buffer (CWE-119). Specifically, the handling of the DataOffset field in SMB responses lacks proper validation, resulting in out-of-bounds memory access. An attacker can exploit this to execute arbitrary code remotely without authentication, running code in kernel context. The CVSS v3.0 base score is 10.0, indicating critical severity. The vulnerability was assigned by ZDI as ZDI-CAN-28345 and published on 2026-04-11.

Successful exploitation allows remote attackers to execute arbitrary code on the affected device with kernel-level privileges, potentially leading to full system compromise. No authentication is required, increasing the risk of exploitation. The vulnerability affects Sonos Era 300 version 17.5 (build 91.0-70070). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Until a patch is available, restrict network access to the affected device and monitor for unusual SMB traffic targeting the device.