# CVE-2026-56719: MikroTik RouterOS out-of-bounds read in SMB daemon

Source: https://junglewise.ai/threats/cve-2026-56719-mikrotik-routeros-out-of-bounds-read-in-smb-daemon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-56719 · Severity: medium · CVSS 6.5 · Published 2026-09-16

MikroTik RouterOS includes an SMB file-sharing service that can be accessed from the network. An unauthenticated attacker can exploit a flaw in how the SMB daemon processes login requests to read sensitive data from the router's memory, potentially exposing configuration details, credentials, or other confidential information without authentication.

Technologies: [MikroTik RouterOS](https://junglewise.ai/threats/technologies/routeros). Vendors: [MikroTik](https://junglewise.ai/threats/vendors/mikrotik).

## Quick answers

**Is CVE-2026-56719 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56719 being exploited in the wild.

**How severe is CVE-2026-56719?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** MikroTik RouterOS before 7.24; specifically 6.49.18 and earlier, 7.0.0–7.23.x.

**Is there a fix for CVE-2026-56719?** A patch was published on 2026-08-14: Fix included in RouterOS 7.24 stable release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56719 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-56719?** Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds read (CWE-125) in the userspace SMB daemon's SessionSetupAndX handler. An attacker can craft a minimal SMB1 SessionSetupAndX frame with a malicious uniPwdLen field value to trigger a read beyond the end of the request buffer. The flaw occurs before credential validation, meaning no SMB authentication is required. A network-based attacker can read arbitrary memory contents, potentially exposing sensitive data from the router process. The vulnerability is fixed in RouterOS 7.24 and later; affected versions include 6.49.18 and earlier, and 7.0.0 through 7.23.x.

## Affected products

- MikroTik RouterOS before 7.24; specifically 6.49.18 and earlier, 7.0.0–7.23.x

## Timeline

- 2026-09-16: disclosed: CVE-2026-56719 disclosed
- 2026-08-14: patched: Fix included in RouterOS 7.24 stable release

## References

- [https://forum.mikrotik.com/t/7-24-stable-is-released/272381](https://forum.mikrotik.com/t/7-24-stable-is-released/272381)
- [https://www.vulncheck.com/advisories/mikrotik-routeros-out-of-bounds-read-via-smb1-sessionsetupandx](https://www.vulncheck.com/advisories/mikrotik-routeros-out-of-bounds-read-via-smb1-sessionsetupandx)

## Related threats

- [MikroTik RouterOS session token replay authentication bypass in WebFig](https://junglewise.ai/threats/cve-2026-89035-mikrotik-routeros-through-7-24-5-contains-a-session-token-replay)
- [MikroTik RouterOS integer overflow in ipt_SAME module](https://junglewise.ai/threats/cve-2026-112158-a-weakness-has-been-identified-in-mikrotik-routeros-up-to-6-40-5)
- [MikroTik RouterOS WinBox incorrect authorization in authentication](https://junglewise.ai/threats/cve-2026-103903-an-incorrect-authorization-vulnerability-in-the-winbox)
- [MikroTik RouterOS integer underflow](https://junglewise.ai/threats/cve-2026-84411-mikrotik-routeros)
- [MikroTik RouterOS improper input validation in BGP labelled-VPN NLRI](https://junglewise.ai/threats/cve-2026-93345-mikrotik-routeros-before-7-25beta4-contains-an-improper-input)