This vulnerability (CVE-2026-4149) in Sonos Era 300 involves improper restriction of operations within the bounds of a memory buffer (CWE-119) during the handling of the DataOffset field in SMB responses. Due to lack of proper validation of user-supplied data, an attacker can cause out-of-bounds memory access, enabling remote code execution in kernel context without requiring authentication. The affected version is 17.5 (build 91.0-70070). The vulnerability was reported by ZDI as ZDI-CAN-28345 and has a CVSS 3.0 base score of 10.0, reflecting its critical impact.

Successful exploitation allows remote attackers to execute arbitrary code on the affected Sonos Era 300 device with kernel privileges, potentially leading to full system compromise. No authentication is required to exploit this vulnerability, increasing its risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device, especially blocking SMB traffic from untrusted sources. Monitor vendor communications for updates on patches or mitigations.