CVE-2026-110714 sahlberg CVE debrief

Who should care

Defenders responsible for libsmb2 deployments, SMB server administrators, and security teams monitoring for suspicious activity should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-110714 is a high-severity vulnerability in libsmb2 that allows malicious SMB servers to trigger heap out-of-bounds reads. Defenders should prioritize verification and remediation to prevent potential denial of service and data breaches.

• Potential denial of service due to heap out-of-bounds reads
• Possible data breaches through crafted security descriptors
• Required verification of libsmb2 versions and SMB activity monitoring
• Necessity for compensating controls to limit exposure

Technical summary

libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. The vulnerability is caused by an integer underflow in the decode_acl function, which can be triggered by a malicious SMB server sending an AclSize below 8 in a QUERY_INFO reply. This can bypass ACE bounds checks and crash the client. Defenders should prioritize verifying and updating libsmb2 versions, monitoring for suspicious SMB activity, and implementing compensating controls to limit exposure.

Defensive priority

Defenders should prioritize verifying and updating libsmb2 versions, monitoring for suspicious SMB activity, and implementing compensating controls to limit exposure.

Recommended defensive actions

• Verify and update libsmb2 versions to 6.3 or later
• Monitor for suspicious SMB activity
• Implement compensating controls to limit exposure
• Review and update incident response plans
• Conduct vulnerability scanning and risk assessments
• Develop and test exploit detection rules
• Track and analyze libsmb2-related security events

Evidence notes

The CVE record and source item provide details on the integer underflow vulnerability in libsmb2. Additional information on exploitation and impact is limited. Defenders should verify libsmb2 versions, monitor for suspicious SMB activity, and implement compensating controls to limit exposure. The vulnerability is highly severe, with a CVSS score of 7.1, and defenders should prioritize verification and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.