# CVE-2025-10230: Samba command injection in WINS hook handling

Source: https://junglewise.ai/threats/cve-2025-10230-samba-command-injection-in-wins-hook-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-07. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-10230 · Severity: critical · CVSS 10 · Published 2025-11-07

Samba, a widely used software for sharing files and managing network identities, contains a critical security flaw in its WINS server component. An unauthenticated attacker can send specially crafted network packets to take complete control of the server. This could lead to the theft of sensitive company data, disruption of network services, or a total takeover of the organization's domain controller.

Technologies: [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2025-10230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10230 being exploited in the wild.

**How severe is CVE-2025-10230?** Critical severity, with a CVSS score of 10, published 7 November 2025.

**Which products and versions are affected?** Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2.

**Is there a fix for CVE-2025-10230?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-10230 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-10230?** Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Samba's front-end WINS hook handling. The root cause is the failure to properly validate or escape NetBIOS names received from registration packets before passing them to a shell command via the 'wins hook'. An unauthenticated network attacker can exploit this by sending malicious WINS registration packets containing shell metacharacters. Successful exploitation results in remote command execution (RCE) with the privileges of the Samba process, typically on an Active Directory Domain Controller. The vulnerability is addressed in Samba versions 4.21.9, 4.21.5 (for the 4.22 branch), and 4.23.2.

## Affected products

- Samba Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2

## Timeline

- 2025-09-10: disclosed: Initial report in Red Hat Bugzilla
- 2025-11-07: advisory: NVD publication date

## References

- [https://www.samba.org/](https://www.samba.org/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2025-10230](https://access.redhat.com/security/cve/CVE-2025-10230)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2394377](https://bugzilla.redhat.com/show_bug.cgi?id=2394377)
- [https://www.samba.org/samba/history/security.html](https://www.samba.org/samba/history/security.html)
- [https://www.vicarius.io/vsociety/posts/cve-2025-10230-detect-samba-vulnerability](https://www.vicarius.io/vsociety/posts/cve-2025-10230-detect-samba-vulnerability)
- [https://www.vicarius.io/vsociety/posts/cve-2025-10230-mitigate-samba-vulnerability](https://www.vicarius.io/vsociety/posts/cve-2025-10230-mitigate-samba-vulnerability)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)