Brief Summary: Sonos Era 300 CVE-2026-4149 Kernel Level RCE via SMB Response Out of Bounds Access

Introduction

A maximum-severity vulnerability in the Sonos Era 300 smart speaker lets unauthenticated remote attackers gain kernel-level code execution by sending a crafted SMB response over the network. CVE-2026-4149 was discovered by researcher dmdung of STAR Labs SG Pte. Ltd. and disclosed through the Zero Day Initiative as ZDI 26 192. It carries a CVSS base score of 10.0, and exploiting it requires neither authentication nor user interaction.

The Sonos Era 300 is a premium smart speaker designed for spatial audio. It belongs to the Sonos ecosystem, which spans millions of connected devices in homes and commercial environments worldwide. Sonos products are deeply integrated into home and office networks and often sit on the same LAN segments as workstations and servers. A kernel-level compromise on one of these devices is therefore a meaningful foothold for lateral movement.

Technical Information

Root Cause: Unvalidated DataOffset in SMB Response Handling

The vulnerability is in the SMB (Server Message Block) response handler in the Sonos Era 300 firmware. When the device processes an incoming SMB response, it reads a DataOffset field to find where the payload data begins inside the response buffer. The firmware uses this offset for memory operations without first checking it against the boundaries of the allocated buffer.

This is a classic CWE 119 condition, Improper Restriction of Operations within the Bounds of a Memory Buffer. The attacker controls the DataOffset value, because it comes directly from the SMB response packet. With no bounds check in place, a malicious value makes the firmware read or write memory past the end of the allocated buffer.

Why This Is Kernel Level

The SMB handling code on the Sonos Era 300 runs at a privileged level within the system. Successful exploitation of the out-of-bounds access gives the attacker code execution in the context of the kernel, which goes well beyond crashing a userspace process. The attacker gains the highest level of control over the device and can read and modify any data, install persistent implants, or pivot to other devices on the network.

CVSS 3.0 Breakdown

The full CVSS 3.0 vector string is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

The "Changed" scope reflects that a kernel compromise on a network-connected device can affect resources beyond the speaker itself, such as other devices on the same network segment.

Attack Flow

Based on the disclosed details, exploitation would follow this general sequence:

1. The attacker identifies a Sonos Era 300 device on the target network. These devices are discoverable through standard network scanning or multicast discovery protocols.
2. The attacker initiates or intercepts an SMB transaction with the target device. Because the vulnerability is in the handling of SMB responses, the attacker needs the device to process a crafted SMB response. Acting as a rogue SMB server on the network or holding a man-in-the-middle position would both achieve this.
3. The attacker crafts an SMB response whose DataOffset field holds a malicious value pointing past the end of the allocated response buffer.
4. When the Sonos Era 300 processes this response, the unvalidated offset causes an out-of-bounds memory access.
5. By carefully controlling the offset and the contents of the response, the attacker achieves arbitrary code execution in kernel context.

No step requires authentication or user interaction. The device only needs to be reachable on the network and processing SMB traffic.

Disclosure Timeline

Patch Information

Sonos fixed CVE-2026-4149 in firmware version 83.1 61240, released on February 4, 2025. The ZDI 26 192 advisory confirms this directly, stating the vulnerability is "Fixed in version 83.1 61240." The official Sonos system update release notes corroborate it, listing that version under the changelog entry "Security improvements."

The fix targets the SMB response handler component in the Sonos Era 300 firmware. Before the patch, the firmware did not properly validate user-supplied data in the DataOffset field, so an attacker could craft an SMB response that made the device access memory past the end of an allocated buffer. The patch adds bounds checking and validation of the DataOffset field in SMB responses. Any externally supplied offset is now checked against the actual buffer boundaries before memory is accessed.

The fix is firmware-level and ships through Sonos's standard over-the-air update mechanism, so there is no public source code commit or diff to inspect. Sonos systems update automatically by default, which means most active Era 300 devices will have already received this patch. Users can check their firmware version in the Sonos app under Settings > General Settings > System Updates and start a manual update if needed. Any device running firmware 83.1 61240 or later is patched against this vulnerability.

The databases report affected and fixed versions differently:

Based on the Zero Day Initiative advisory, administrators should treat version 83.1 61240 as the authoritative minimum safe build.

Affected Systems and Versions

The vulnerability affects the Sonos Era 300 smart speaker. Based on available disclosures:

• The CVE record on CVE.org lists the affected version as 17.5 (build 91.0 70070).
• The Zero Day Initiative advisory confirms the fix is in firmware version 83.1 61240.
• Any Sonos Era 300 device running firmware prior to 83.1 61240 should be considered vulnerable.

The advisory does not explicitly name any other Sonos products. Organizations with mixed Sonos deployments should still watch for additional advisories.

Vendor Security History

Sonos runs a formal security program with a published Vulnerability Disclosure Policy and a dedicated page recognizing security researchers. The company publicly commits to providing software security updates for its products.

Sonos handled CVE-2026-4149 through a standard coordinated disclosure process. The vulnerability was reported in November 2025, and a firmware fix was available well before the public advisory release in March 2026. That indicates an active product security incident response capability with reasonable turnaround times for critical issues.

References

• ZDI 26 192: Sonos Era 300 SMB Response Out of Bounds Access Remote Code Execution Vulnerability
• NVD Entry for CVE-2026-4149
• CVE.org Record for CVE-2026-4149
• Sonos System Update Release Notes
• Update Your Sonos Speakers
• Sonos Platform Security Information
• Sonos Security Software Updates Policy
• VulDB Entry for CVE-2026-4149
• CISA Known Exploited Vulnerabilities Catalog