UBUNTU-CVE-2025-57632

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-57632
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-57632.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-57632
Upstream
Published
2025-09-25T20:15:00Z
Modified
2025-10-10T18:02:28.808267Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2addiovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2MAXVECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2OPLOCKBREAK path bypasses message ID validation.

References

Affected packages

Ubuntu:25.10 / libsmb2

Package

Name
libsmb2
Purl
pkg:deb/ubuntu/libsmb2@6.2+dfsg-2?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.2+dfsg-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "6.2+dfsg-2",
            "binary_name": "libsmb2-6"
        },
        {
            "binary_version": "6.2+dfsg-2",
            "binary_name": "libsmb2-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-57632.json"