Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to Samba domain with valid credentials
  2. Delivery
    Craft kpasswd request with malformed ASN.1 encoding
  3. Exploit
    Send request to KDC on port 464
  4. Execution
    Trigger buffer size miscalculation in ASN.1 parser
  5. Persist
    Out-of-bounds read hits unmapped memory
  6. Impact
    KDC process crashes, denying domain authentication

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the attacker to hold at least low-privileged authenticated access to the Kerberos realm (PR:L per CVSS vector) - unauthenticated attackers cannot trigger this flaw. The target Samba server must be operating as a KDC with the kpasswd service running and reachable on port 464. Successful denial of service further depends on the out-of-bounds read crossing into unmapped virtual memory, which is influenced by heap layout at the time of the request; reads into adjacent mapped memory instead result only in a failed decryption, not a crash. This memory-layout dependence is the basis for the AC:H CVSS rating. Exploitation is limited to systems where Samba provides Active Directory Domain Services or acts as a Kerberos KDC; standalone Samba file-server deployments without KDC functionality are not affected.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H yields a base score of 5.3, reflecting that exploitation is network-reachable but requires authentication (PR:L) and high attack complexity (AC:H). The AC:H rating is appropriate because successful DoS depends on the out-of-bounds read crossing into unmapped memory - a probabilistic, memory-layout-dependent condition. No EPSS data was provided in the input; absence of a KEV listing and absence of any known public exploit code indicate limited threat actor interest at time of analysis. The tags include 'Information Disclosure,' which aligns with the theoretical possibility of reading adjacent heap contents, but the CVE description characterizes this secondary path as a 'harmless decryption failure,' making it an unlikely practical concern. Real-world risk is most acute in environments where Samba serves as the sole or primary KDC: an attacker with domain credentials can repeatedly crash the KDC, degrading or eliminating authentication services until the process is restarted. Environments with KDC redundancy (multiple domain controllers) are more resilient. Overall, this is a moderate-severity, operationally impactful DoS for single-DC deployments, not a critical confidentiality or integrity threat.
Exploit ScenarioDerived

An attacker with valid domain credentials authenticates to a Samba-based domain and sends a specially crafted kpasswd request over port 464 containing deliberately malformed ASN.1 encoding. The Samba KDC miscalculates the structure length, reads beyond the buffer boundary, and if that read crosses an unmapped memory page, the KDC process crashes - denying authentication services to all domain members until the service is restarted. No public proof-of-concept code has been identified at time of analysis, but the attack primitive (crafting malformed ASN.1) is within reach of any attacker familiar with Kerberos protocol internals.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.

RemediationAI

A vendor-released patch is available per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58216 and the upstream Samba security advisory at https://www.samba.org/samba/security/CVE-2026-58216.html; administrators should apply the patched Samba packages for their RHEL or Ubuntu release via standard package management (yum/dnf update samba or apt-get upgrade samba). Exact fixed version numbers were not confirmed in the provided data - verify the specific patched package version against the vendor advisories before deploying. As a compensating control prior to patching, access to the kpasswd service (UDP/TCP port 464) can be restricted at the network perimeter or host firewall to only trusted hosts that require password changes, reducing the attacker pool to those already on trusted network segments; note that this may break password-change workflows for remote or off-network users. Deploying a secondary KDC (additional domain controller) as a redundancy measure limits availability impact even if the primary KDC is crashed, and is recommended regardless of patching status for production environments.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Samba implements the Kerberos Key Distribution Center (KDC) including the kpasswd service, which handles password change requests over UDP/TCP port 464 using ASN.1-encoded Kerberos protocol messages. The flaw is an out-of-bounds read (CWE-125) rooted in faulty size calculation when parsing the ASN.1 structure of a kpasswd request: the code computes a structure length incorrectly and subsequently reads up to six bytes past the end of the heap-allocated buffer. In most cases the stale or zeroed bytes read from adjacent allocated memory cause only a decryption failure, but if the overrun crosses into an unmapped virtual-memory page, the operating system delivers a SIGSEGV or similar signal that terminates the KDC process. Affected deployments according to CPE data span Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, all of which ship Samba as their domain controller implementation.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.3 MEDIUM

Network-reachable kpasswd service; AC:H because DoS requires probabilistic unmapped-memory hit; PR:L for required domain authentication; no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Prevalence
High
widely deployed as Linux/Unix Active Directory domain controller
Social Media
1
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/samba-client:latest Container suse/samba-toolbox:latest Affected
Container suse/samba-server:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-BYOS-EC2 Affected
SUSE Enterprise Storage 7.1 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58216 ADVISORY https://ubuntu.com/security/notices/USN-8621-1 ADVISORY https://vuldb.com/vuln/384858 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22977/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3362/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3363/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3364/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3365/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3366/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3367/ REF https://access.redhat.com/security/cve/CVE-2026-58216 REF https://bugzilla.redhat.com/show_bug.cgi?id=2502721 REF https://bugzilla.samba.org/show_bug.cgi?id=16087 REF https://www.samba.org/samba/security/CVE-2026-58216.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy