---
id: GO-2026-5051
title: >-
  Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and
  github.com/hirochachacha/go-smb2
summary: >-
  Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and
  github.com/hirochachacha/go-smb2
severity: none
vendor: cloudsoda
product: github.com/cloudsoda/go-smb2
ecosystem: go
affected:
  - github.com/cloudsoda/go-smb2 < 0.0.0-20260609183447-7b96c35f5f4b
  - github.com/hirochachacha/go-smb2
patched:
  - github.com/cloudsoda/go-smb2 0.0.0-20260609183447-7b96c35f5f4b
published: '2026-07-27'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5051'
references:
  - url: >-
      https://github.com/cloudsoda/go-smb2/commit/7b96c35f5f4babfc9d68a60baf5e85f2303d4a4b
  - url: 'https://github.com/golang/vulndb/issues/5051'
tags:
  - osv
  - go
ingestedAt: '2026-07-27T19:08:55.749Z'
---

## Overview

ReadDir and ReadDirPlus parse the QUERY_DIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int after narrowing from uint16.

A guest or anonymous directory listing against an attacker-controlled or man-in-the-middle SMB server crashes the Go client process with a runtime panic when the response contains an entry whose NextEntryOffset is larger than the remaining buffer, or whose declared FileNameLength produces a length that does not match the actual buffer size.

## Affected packages

- `github.com/cloudsoda/go-smb2 < 0.0.0-20260609183447-7b96c35f5f4b`
- `github.com/hirochachacha/go-smb2`

## Remediation

Upgrade to a patched release:

- `github.com/cloudsoda/go-smb2 0.0.0-20260609183447-7b96c35f5f4b`