Threat database

libsmb2 versions before 6.3 contain integer overflow vulnerabilities in the DCE/RPC NDR decoder. These flaws allow heap out-of-bounds reads and writes when processing crafted NetrShareEnum replies, potentially leading to heap memory corruption. The issue can be triggered by a malicious SMB server or a man-in-the-middle on unsigned connections during smb2_share_enum_async() calls.

libsmb2 versions up to 6.2 contain an integer underflow vulnerability in the decode_acl function. This flaw allows malicious SMB servers to send crafted security descriptors with an AclSize below 8, bypassing access control entry (ACE) bounds checks. This can lead to heap out-of-bounds reads and cause the client to crash. The vulnerability affects clients interacting with untrusted or malicious SMB servers or intercepting unsigned sessions.

libsmb2 versions up to and including 6.2 have a heap out-of-bounds read vulnerability in the smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info functions. This flaw allows malicious SMB servers or attackers intercepting unsigned sessions to send crafted QUERY_INFO replies with manipulated name lengths, potentially causing the client to read beyond allocated buffers and crash. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.

libsmb2 versions up to and including 6.2 contain a heap out-of-bounds read vulnerability in the smb2_decode_file_all_info function. This flaw allows malicious SMB servers or man-in-the-middle attackers on unsigned sessions to crash clients by sending a crafted FileAllInformation response with an unchecked FileNameLength. The vulnerability can be triggered by smb2_stat or smb2_fstat calls, leading to client crashes.

CVE-2026-108985 is a high severity vulnerability in the sahlberg libnfs library affecting versions 0 through 6.0.2. It involves an out-of-bounds write in the ZDR decoding functionality where the maxsize parameter supplied by the caller is not properly enforced. This flaw exists in functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array() within lib/libnfs-zdr.c. The vulnerability can lead to a denial of service due to an out-of-bounds write but does not impact confidentiality.

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.