{"id":"DEBIAN-CVE-2026-110714","details":"libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.","modified":"2026-10-17T12:00:06.699938222Z","published":"2026-10-14T16:17:43.473Z","upstream":["CVE-2026-110714"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-110714"}],"affected":[{"package":{"name":"libsmb2","ecosystem":"Debian:13","purl":"pkg:deb/debian/libsmb2?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg-2","6.2+dfsg-2+deb13u1","6.2+dfsg-3","6.2+dfsg-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110714.json"}},{"package":{"name":"libsmb2","ecosystem":"Debian:14","purl":"pkg:deb/debian/libsmb2?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg-2","6.2+dfsg-3","6.2+dfsg-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110714.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}