This vulnerability (CVE-2026-4149) in Sonos Era 300 involves improper restriction of operations within the bounds of a memory buffer (CWE-119) during the handling of the DataOffset field in SMB responses. Due to lack of proper validation of user-supplied data, an attacker can cause out-of-bounds memory access, enabling remote code execution in kernel context without authentication. The CVSS v3.0 base score is 10.0, reflecting its critical severity and ease of exploitation over the network without privileges or user interaction. The affected version is 17.5 (build 91.0-70070). No patch or official remediation has been published yet.

Successful exploitation allows remote attackers to execute arbitrary code on the Sonos Era 300 device with kernel-level privileges, potentially leading to full system compromise. The vulnerability requires no authentication and can be triggered remotely over the network via crafted SMB responses. This poses a critical risk to affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially blocking SMB traffic from untrusted sources. Monitor vendor communications for updates on patches or mitigations.