Threat Intelligence Database

libsmb2 versions up to and including 6.2 contain an integer underflow vulnerability in the decode_acl function. This flaw allows malicious SMB servers to cause heap out-of-bounds reads by sending crafted security descriptors with an AclSize value below 8 in QUERY_INFO replies. Exploitation can lead to client crashes. The vulnerability requires no privileges but user interaction is needed, and it has a high severity rating.

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.