Description

Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:59.240Z",
  "pubdate": "2026-08-11T17:18:59.240Z",
  "executiveSummary": "This vulnerability is classified as a buffer over-read affecting the Windows Server Message Block (SMB) Client. The flaw allows an unauthorized remote attacker to execute unauthorized memory reads, resulting in the disclosure of sensitive information over the network.\nThe affected product is the Windows SMB Client across applicable versions. The risk implications include the potential exposure of sensitive kernel memory contents, which could be leveraged by threat actors to facilitate secondary exploitation phases, such as bypassing security controls like Address Space Layout Randomization (ASLR).\nAttacker capabilities are constrained to information disclosure; however, exploitation can be performed remotely over the network by an unauthenticated adversary without requiring prior access to the target system.\nSpecific exploitation requirements generally involve the target system interacting with a malicious server or processing maliciously crafted SMB responses designed to trigger the out-of-bounds read condition within the client-side parsing logic.",
  "technicalDetails": "The root cause of the vulnerability resides in the Windows SMB Client component, specifically within the routines responsible for parsing incoming SMB protocol packets and managing associated data buffers. Due to insufficient bounds checking and improper validation of length fields returned in server responses, the client attempts to read data past the allocated boundary of the input buffer.\nThe vulnerable component is the SMB Client driver or associated networking libraries responsible for handling SMB session establishment and transaction responses over network sockets utilizing the SMB protocol.\nNetwork exposure is present whenever the Windows SMB Client initiates or maintains connections with external or untrusted SMB servers. The attack vector is network-based, requiring the attacker to either spoof a legitimate server, compromise an existing server, or induce the victim client to connect to a malicious endpoint controlled by the adversary.\nAuthentication requirements are nonexistent for initiating the attack flow, as the vulnerability can be triggered during the initial phases of connection negotiation or protocol handshaking before session authentication is fully established. Privilege requirements are similarly absent, as an unprivileged network entity can induce the fault.\nThe stepwise attack flow initiates when the Windows SMB Client sends a valid request to an SMB server. The malicious or compromised server responds with a crafted SMB packet containing manipulated length descriptors or payload headers. Upon receipt, the vulnerable SMB Client fails to properly validate the declared data length against the actual allocated buffer size. When the parsing routine executes, it reads sequential memory addresses beyond the intended buffer limits, capturing adjacent heap or stack data. The leaked memory contents are subsequently encapsulated or processed in subsequent logic, potentially echoing sensitive kernel memory fragments back to the attacker or causing aberrant client behavior depending on how the over-read data is handled.\nThe payload behavior is strictly passive regarding system modification but active regarding data exfiltration; it does not result in remote code execution directly, but the disclosed memory structures significantly increase the probability of successful secondary exploits by revealing memory layouts and pointer references."
}