CVE-2025-57632

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2addiovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2MAXVECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2OPLOCKBREAK path bypasses message ID validation.

References

Affected packages

Git / github.com/sahlberg/libsmb2

Affected ranges

Type: GIT
Repo: https://github.com/sahlberg/libsmb2
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

5e75eebf922b338cdb548d60cffb3b997d2a12e8

Affected versions

libsmb2-1.*

libsmb2-1.0

libsmb2-6.*

libsmb2-6.0

libsmb2-6.1

libsmb2-6.2

v1.*

v1.0.0

v2.*

v2.0.0

v3.*

v3.0.0

v4.*

v4.0.0

v5.*

v5.0.0

v6.*

v6.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57632.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "source": "https://github.com/sahlberg/libsmb2/commit/5e75eebf922b338cdb548d60cffb3b997d2a12e8",
        "id": "CVE-2025-57632-4f1be132",
        "deprecated": false,
        "target": {
            "file": "lib/init.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "3604715068656525057895732284933582250",
                "67474392744342636332293879522589848281",
                "106544564087878161484972033647860944301"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/sahlberg/libsmb2/commit/5e75eebf922b338cdb548d60cffb3b997d2a12e8",
        "id": "CVE-2025-57632-cb3b4191",
        "deprecated": false,
        "target": {
            "function": "smb2_add_iovector",
            "file": "lib/init.c"
        },
        "signature_version": "v1",
        "digest": {
            "length": 375.0,
            "function_hash": "34543669183881933262336254942550366083"
        }
    }
]