CVE catalog

CVE-2025-57632

DEBIAN-CVE-2025-57632

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.58% · Oct 25, 2026

libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2_OPLOCK_BREAK path bypasses message ID validation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsmb2136.2+dfsg-2vulnerable
Debianlibsmb2136.2+dfsg-2+deb13u1fixed
Debianlibsmb2146.2+dfsg-2vulnerable
Debianlibsmb2146.2+dfsg-3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsmb2deb136.2+dfsg-2+deb13u1Not reportedDEBIAN-CVE-2025-57632Not reported
Debianlibsmb2deb146.2+dfsg-3Not reportedDEBIAN-CVE-2025-57632Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [libsmb2-6]Fixed

    Source package: [libsmb2]

    Details (2)

    • 6.2+dfsg-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 6.2+dfsg-2+deb13u1

      pypi · libsmb2 · debian · 13

    • 6.2+dfsg-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 6.2+dfsg-2+deb13u1

      pypi · libsmb2 · debian · 13

  • [libsmb2-dev]Fixed

    Source package: [libsmb2]

    Details (2)

    • 6.2+dfsg-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 6.2+dfsg-2+deb13u1

      pypi · libsmb2 · debian · 13

    • 6.2+dfsg-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 6.2+dfsg-2+deb13u1

      pypi · libsmb2 · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]