# CVE-2026-3238: Samba WINS server NULL pointer dereference in Active Directory Domain Controller

Source: https://junglewise.ai/threats/cve-2026-3238-samba-wins-server-null-pointer-dereference-in-active-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-3238 · Severity: high · CVSS 7.5 · Published 2026-06-08

A security flaw exists in Samba when it is configured as an Active Directory Domain Controller with WINS support enabled. This component helps manage computer names on a network. An attacker can send a specially crafted network message to crash this service, potentially disrupting network name resolution and causing a denial of service for users and systems relying on the domain controller.

Technologies: [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-3238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3238 being exploited in the wild.

**How severe is CVE-2026-3238?** High severity, with a CVSS score of 7.5, published 8 June 2026.

**Which products and versions are affected?** Samba All versions since 4.0 before 4.22.10, 4.23.8, 4.24.3.

**Is there a fix for CVE-2026-3238?** A patch was published on 2026-06-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3238 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3238?** Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in Samba's WINS server component when configured as an Active Directory Domain Controller. The flaw is located in the protocol handlers for RELEASE and MULTI_HOME_REG packets, which fail to properly validate incoming requests. An unauthenticated remote attacker can exploit this by sending specially crafted UDP packets to the WINS service, triggering a crash. While the service may restart, the ease of exploitation allows for a sustained denial-of-service state. This vulnerability only affects installations where 'wins support = yes' is explicitly enabled in the smb.conf file. Patches are available in versions 4.22.10, 4.23.8, and 4.24.3.

## Affected products

- Samba Samba All versions since 4.0 before 4.22.10, 4.23.8, 4.24.3

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-06-08: patched

## References

- [https://access.redhat.com/security/cve/CVE-2026-3238](https://access.redhat.com/security/cve/CVE-2026-3238)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2486176](https://bugzilla.redhat.com/show_bug.cgi?id=2486176)
- [https://www.samba.org/samba/security/CVE-2026-3238.html](https://www.samba.org/samba/security/CVE-2026-3238.html)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)