External risk intelligence

Sonos Era 300 SMB Out-of-Bounds Access Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-4149

The affected product is a consumer home audio device (Sonos Era 300). Such devices are intended for operation within local area networks and are typically protected from direct public internet exposure by consumer routers and firewalls. SMB protocol usage is standard for local network communication and is not designed or intended to be exposed to the public internet.

Memory Corruption

Sonos Era 300 Firmware

before 83.1-61240

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Sonos Era 300 devices related to how they handle network responses, potentially allowing attackers to execute malicious code remotely without any authentication. This issue stems from an inability to properly validate data, which could lead to unauthorized code execution within the system's core.

Flaw allows remote code execution on Sonos Era 300.
Critical vulnerability poses a significant security risk.
Confirm relevance and exposure; consumer devices are less likely targets.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by sending specially crafted SMB responses to a vulnerable Sonos Era 300 device. This bypasses the need for any authentication or user interaction. The vulnerability lies in how the device processes the DataOffset field within these responses, leading to an out-of-bounds memory access that could allow for arbitrary code execution.

No authentication required for exploitation.
Triggered by specially crafted SMB responses.
Allows remote code execution as kernel.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary code on affected Sonos Era 300 devices by sending specially crafted SMB responses. This could lead to a complete compromise of the device.

Sonos Era 300 devices.
Via network-level SMB response manipulation.
Arbitrary code execution on the device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Sonos Era 300 vulnerability requires immediate attention from teams responsible for network-attached devices and home entertainment systems. The first practical step is to identify all Sonos Era 300 devices, confirm their network accessibility, and determine business criticality. Subsequently, the accountable owner should be identified to plan and execute remediation, potentially involving coordination with the vendor or implementing temporary risk reduction measures.

Device owners should manage remediation efforts.
Verify device network exposure and criticality.
Plan for vendor-supported firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sonos Era 300?

The Sonos Era 300 is a high-fidelity smart speaker designed for home audio. It connects to your local network to stream music and integrate with other home entertainment systems. This vulnerability affects the device's firmware, which is the internal software that manages its network communication and audio processing.

What does out-of-bounds access mean for CVE-2026-4149?

This vulnerability is classified as CWE-119, or improper restriction of operations within the bounds of a memory buffer. In plain terms, the speaker's software fails to check the size of incoming data correctly. By sending a malformed SMB message, an attacker can force the device to read or write memory outside of its designated space, which can lead to running unauthorized code.

How is this Sonos Era 300 vulnerability triggered?

An attacker must send a specially crafted SMB network response to the device. The vulnerability specifically targets the DataOffset field, which tells the software where to find information in a packet. Simply sending standard, valid network traffic or normal audio streaming data will not trigger this issue; it requires a malicious, malformed packet designed to exploit this memory handling flaw.

Is my Sonos Era 300 at risk if it is on my home network?

According to Halo Surface Signal, this is very unlikely. The Sonos Era 300 is a consumer device intended for local networks, which are typically shielded by your home router or firewall. Because this vulnerability requires direct network communication via SMB, the device is generally not reachable by attackers sitting on the public internet, provided your home network is not misconfigured.

What should I do if I own a Sonos Era 300?

Your first step is to verify your current firmware version to see if it is older than the patched version. Check your Sonos app or administrative interface to manage updates. Ensure your home network remains secured behind a router, and plan to apply any available firmware updates provided by the vendor to resolve the underlying memory validation flaw.

References

www.zerodayinitiative.com/advisories/ZDI-26-192/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.