CVE-2026-110714

Deferred Deferred - Pending Action

Integer Underflow in libsmb2 decode_acl

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110714

EUVD

EUVD-2026-101137

Affected Vendors & Products

Vendor	Product	Version / Range
sahlberg	libsmb2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

libsmb2 through version 6.2 has an integer underflow flaw in the decode_acl function. When processing security descriptors from SMB servers, it fails to validate the AclSize field properly. If an attacker sends a value below 8, it triggers an underflow that bypasses bounds checks, causing heap out-of-bounds reads in the client application.

Detection Guidance

Monitor for crashes in libsmb2-based applications when processing SMB2 security descriptors. Check logs for heap out-of-bounds read errors or segmentation faults during SMB file operations. Use AddressSanitizer or similar tools to detect memory corruption when clients query security descriptors from SMB servers.

Impact Analysis

This vulnerability allows attackers controlling an SMB server or intercepting unsigned sessions to crash client applications by sending maliciously crafted security descriptors. The crash results from heap out-of-bounds reads, leading to denial of service for any software using libsmb2 to access SMB shares.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a client-side heap out-of-bounds read in libsmb2, which is a library for SMB protocol handling. However, if exploited, it could lead to denial-of-service conditions in applications using libsmb2 to access SMB shares, potentially disrupting data availability. Compliance impacts would depend on whether such disruptions affect systems handling regulated data.

Mitigation Strategies

Upgrade libsmb2 to a patched version if available. Avoid connecting to untrusted SMB servers. Disable SMB2/3 signing or encryption if not required. Monitor network traffic for malformed SMB responses. Apply input validation patches for QUERY_INFO replies in SMB clients.

Hi! I’m here to help you understand CVE-2026-110714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70