{"id":"CVE-2026-115505","kind":"vulnerability","aliases":["CVE-2026-115505"],"related":[],"title":"libsmb2: integer overflow in DCE/RPC decoder enables heap memory corruption","description":"libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.","summary":"libsmb2 before 6.3 has integer overflows in its DCE/RPC NDR decoder that cause out-of-bounds heap reads and writes. A malicious SMB server or man-in-the-middle on unsigned connections can send crafted NetrShareEnum replies that corrupt client heap memory.","severity":"high","cvss":7.6,"epss":0.0021,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libsmb2","package","self-hosted","smb"],"not_affected_if":["no-share-enumeration","signed-connections","trusted-servers-only"],"how_to_check":"- Check the libsmb2 version linked into your application or shipped in your package manager, e.g. `dpkg -l | grep libsmb2` or `pkg-config --modversion libsmb2`\n- Search your code for calls to `smb2_share_enum_async()`\n- Check whether SMB connections are made without signing enabled","fix":"- Upgrade libsmb2 to `6.3` or later\n- Require SMB signing on connections where possible","status":"open","published_at":"2026-10-22T20:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:14:21+00:00","updated_at":"2026-10-25T03:14:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:14:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libsmb2 to `6.3` or later\n- Require SMB signing on connections where possible","reach":"network","title":"libsmb2: integer overflow in DCE/RPC decoder enables heap memory corruption","impact":"high","summary":"libsmb2 before 6.3 has integer overflows in its DCE/RPC NDR decoder that cause out-of-bounds heap reads and writes. A malicious SMB server or man-in-the-middle on unsigned connections can send crafted NetrShareEnum replies that corrupt client heap memory.","category":"package","nicknames":[],"who_cares":["libsmb2","smb","c","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker corrupts client heap memory via crafted share enumeration reply","analyst_note":"Confirm the exact vulnerable and fixed versions and which downstream packages bundle libsmb2 at https://nvd.nist.gov/vuln/detail/CVE-2026-115505.","how_to_check":"- Check the libsmb2 version linked into your application or shipped in your package manager, e.g. `dpkg -l | grep libsmb2` or `pkg-config --modversion libsmb2`\n- Search your code for calls to `smb2_share_enum_async()`\n- Check whether SMB connections are made without signing enabled","needs_analyst":true,"not_affected_if":["no-share-enumeration","signed-connections","trusted-servers-only"],"who_is_affected":"Applications that link libsmb2 and call smb2_share_enum_async() to list shares on remote SMB servers are exposed, especially when they connect to servers that are not fully trusted or over networks an attacker can sit on. Systems that never enumerate shares or only talk to trusted, signed SMB servers are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":3424,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115505':13A,16A '-2026':12A,15A '6.3':26B,70C 'actual':112C 'allow':83C 'async':124C 'bound':40B,88C 'c':17B 'call':120C 'caus':36B 'client':65B,119C 'connect':57B,104C 'contain':71C 'corrupt':10A,64B,125C 'count':113C,116C 'craft':60B,107C 'cve':11A,14A 'dce/rpc':5A,32B,77C 'decod':6A,34B,79C 'enabl':7A 'enum':123C 'heap':8A,41B,66B,84C,126C 'host':22B 'integ':2A,28B,72C 'lib/dcerpc.c':81C 'libsmb2':1A,18B,24B,68C 'machin':98C 'machine-in-the-middl':97C 'malici':46B,93C 'man':51B 'man-in-the-middl':50B 'max':115C 'memori':9A,67B,127C 'middl':54B,101C 'ndr':33B,78C 'netrshareenum':61B,108C 'out-of-bound':37B,85C 'overflow':3A,29B,73C 'packag':19B 'read':42B,89C 'repli':62B,109C 'self':21B 'self-host':20B 'send':59B,106C 'server':48B,95C 'share':122C 'smb':23B,47B,94C 'smb2':121C 'unsign':56B,103C 'valu':117C 'vulner':74C 'wrap':111C 'write':44B,91C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libsmb2 and call smb2_share_enum_async() to list shares on remote SMB servers are exposed, especially when they connect to servers that are not fully trusted or over networks an attacker can sit on. Systems that never enumerate shares or only talk to trusted, signed SMB servers are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115505","severity":null,"published_at":"2026-10-22T20:17:06+00:00","modified_at":"2026-10-23T13:19:13+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115505","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115505","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}