Vulnerability · Published Sep 25, 2025 · Assigned by mitre
CVE-2025-57632
High 7.5
In plain English
A high-severity buffer overflow in the libsmb2 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2_OPLOCK_BREAK path bypasses message ID validation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libsmb2 | 6.2+dfsg-2+deb13u1 | DEBIAN-CVE-2025-57632 |
| Debian:14 | libsmb2 | 6.2+dfsg-3 | DEBIAN-CVE-2025-57632 |
| Ubuntu:25.10 | libsmb2 | no fix listed | UBUNTU-CVE-2025-57632 |
| Ubuntu:26.04:LTS | libsmb2 | no fix listed | UBUNTU-CVE-2025-57632 |
| Ubuntu:26.10 | libsmb2 | no fix listed | UBUNTU-CVE-2025-57632 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H