CVE-2026-56719 Overview
CVE-2026-56719 is an out-of-bounds read vulnerability in the userspace Server Message Block (SMB) daemon of MikroTik RouterOS versions before 7.24. An unauthenticated remote attacker can trigger the flaw by sending a crafted SMB1 SessionSetupAndX frame with a malformed uniPwdLen field. The daemon reads past the end of the request buffer before performing any credential validation, potentially exposing sensitive process memory to the attacker. The issue is tracked as CWE-125: Out-of-bounds Read.
Critical Impact
Unauthenticated network attackers can read adjacent memory contents from the RouterOS SMB daemon, exposing information that may include buffer fragments and internal state.
Affected Products
- MikroTik RouterOS versions prior to 7.24
- Devices exposing the userspace SMB daemon (SMB1 enabled)
- All RouterOS deployments with SMB share services reachable over the network
Discovery Timeline
- 2026-09-16 - CVE-2026-56719 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-56719
Vulnerability Analysis
The vulnerability resides in the RouterOS userspace SMB daemon's handler for the SMB1 SessionSetupAndX command. The handler parses the uniPwdLen field from the incoming request to determine how many bytes to read from the Unicode password portion of the frame. The code does not verify that uniPwdLen fits within the remaining bytes of the request buffer. When an attacker supplies a value larger than the actual buffer contents, the parser reads past the end of allocated memory.
The read occurs before authentication logic executes, so no valid credentials are required to reach the vulnerable code path. This positions the flaw as a pre-authentication information disclosure primitive reachable across any network interface where the SMB service listens.
Disclosed memory contents can include heap fragments, stack data, and adjacent request buffers. Attackers may repeat the request to leak additional memory regions and reconstruct sensitive material such as session tokens, password hashes cached by concurrent authentication attempts, or pointers useful for defeating address space layout randomization.
Root Cause
The root cause is missing bounds validation on the attacker-controlled uniPwdLen length field prior to a buffer read in the SessionSetupAndX parser. The daemon trusts the length value from the untrusted SMB1 frame and copies or dereferences memory beyond the packet's actual end.
Attack Vector
Exploitation requires network reachability to the RouterOS SMB service and does not require credentials or user interaction. An attacker sends a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen value that exceeds the true password buffer length. The daemon's response or side channels then reveal out-of-bounds memory contents. See the VulnCheck advisory for protocol-level details.
Detection Methods for CVE-2026-56719
Indicators of Compromise
- Inbound SMB1 traffic on TCP port 445 or 139 from untrusted sources targeting RouterOS devices
- SessionSetupAndX frames with uniPwdLen values inconsistent with the remaining frame length
- Repeated malformed SMB1 negotiation attempts from the same source IP against RouterOS hosts
- Unexpected SMB service crashes or restart events in RouterOS system logs
Detection Strategies
- Inspect SMB1 traffic for SessionSetupAndX requests where declared field lengths exceed the packet body
- Alert on SMB1 protocol negotiation to RouterOS management interfaces, which is uncommon in modern environments
- Correlate SMB scanning activity with reconnaissance from the same source targeting router administrative services
Monitoring Recommendations
- Log all SMB connections to RouterOS devices and forward to a centralized analytics platform for anomaly detection
- Track RouterOS versions across the fleet and flag devices running versions earlier than 7.24
- Monitor for outbound data patterns from RouterOS devices that could indicate memory disclosure exfiltration
How to Mitigate CVE-2026-56719
Immediate Actions Required
- Upgrade all RouterOS devices to version 7.24 or later as announced in the MikroTik 7.24 release notice
- Disable the SMB service on RouterOS devices where file sharing is not required
- Restrict access to SMB ports (139/TCP, 445/TCP) using firewall rules limiting sources to trusted management networks
- Inventory internet-facing RouterOS devices and prioritize patching those with SMB exposed to untrusted networks
Patch Information
MikroTik addressed the vulnerability in RouterOS 7.24. Administrators should apply the update through the standard RouterOS upgrade process and validate that the SMB daemon is running the patched build after reboot. Refer to the MikroTik forum release announcement for the full changelog.
Workarounds
- Disable SMB1 protocol support on RouterOS if the platform allows selective protocol configuration
- Block TCP ports 139 and 445 at the network perimeter and on RouterOS input firewall chains
- Bind the SMB service to internal-only interfaces rather than WAN interfaces
- Deploy network segmentation to isolate RouterOS management planes from user and internet-facing networks
# Configuration example: restrict SMB access on RouterOS
/ip firewall filter add chain=input protocol=tcp dst-port=139,445 \
src-address-list=!trusted-mgmt action=drop comment="Block SMB from untrusted"
# Disable SMB service if unused
/ip smb set enabled=no
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
