CVE-2026-56719

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.24

Description An out-of-bounds read exists in the userspace SMB daemon. Unauthenticated attackers can read beyond the end of the request buffer by providing a crafted uniPwdLen field value within a minimal SMB1 SessionSetupAndX frame. This issue occurs in the SessionSetupAndX handler before credential validation, which may expose sensitive memory contents.

Recommendations Update MikroTik RouterOS to version 7.24 or later.