CVE-2026-115505— libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
Quick assessment
Affected
sahlberg libsmb2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
6.3 版本之前的 libsmb2 在 中的 DCE/RPC NDR 解码器存在整数溢出漏洞，可导致堆内存越界读取和写入。在未经签名的连接中，恶意的 SMB 服务器或中间人攻击者可向调用 的客户端发送经过篡改的 响应，其中包含发生回绕（wrapping）的 或 值，从而破坏堆内存。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115505
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
Source: CVE Program / CVE List V5
Vulnerability Description
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-115505
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115505
请登录查看更多情报信息。
Other References for CVE-2026-115505 (5)
-
https://github.com/sahlberg/libsmb2/issues/496 issue-tracking
-
IV. Related Vulnerabilities
Same vendor: sahlberg
-
CVE-2026-110714
libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl I -
CVE-2026-110713
libsmb2 through 6.2 Heap Out-of-Bounds Read via File System -
CVE-2026-110712
libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_ -
CVE-2026-108985
libnfs<=6.0.2越界写入漏洞 -
CVE-2026-57918
Ronnie Sahlberg libnfs 数字错误漏洞
Same weakness: CWE-190
-
CVE-2026-115387
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 be -
CVE-2026-114645
Heap overflow via 32-bit length wrap of the URI username in -
CVE-2026-110264
Integer Overflow or Wraparound in GitLab -
CVE-2026-96641
Pillow: Reachable undefined behavior in native integer opera -
CVE-2026-111074
JITServer: Pre-authentication remote Denial of Service via i
V. Comments for CVE-2026-115505
No comments yet