CVE-2026-110712
Description
A flaw was found in libsmb2. A malicious Server Message Block (SMB) server, or an attacker conducting a man-in-the-middle attack on an unsigned network session, can trigger a Denial of Service (DoS) by returning crafted file information responses with an unchecked file name length. This issue leads to an out-of-bounds read condition during response decoding, causing the client application to crash.
Statement
Red Hat Product Security rates this vulnerability as having a Moderate impact because successful exploitation requires a client application to interact with an untrusted SMB share or an adversary intercepting unauthenticated network traffic. The resulting out-of-bounds read terminates only the client-side process, preventing any unauthorized modification of system state or code execution. Because libsmb2 functions exclusively as a userspace client library rather than an exposed system service, the impact is confined to applications that actively query remote file metadata.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
