CVE-2026-58216: Samba KDC out-of-bounds read in kpasswd service

CVE-2026-58216 · Severity: medium · CVSS 5.3 · Published 2026-07-30

Samba is a widely used suite of programs that allows Linux and Unix systems to share files and printers with Windows systems. A vulnerability in its password change service (kpasswd) could allow a logged-in user to crash the authentication server by sending a specially crafted request. While this does not allow the attacker to steal data, it can disrupt network operations by causing a denial of service.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Samba. Vendors: Red Hat, Samba.

Quick answers

Is CVE-2026-58216 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58216 being exploited in the wild.
How severe is CVE-2026-58216?
Medium severity, with a CVSS score of 5.3, published 30 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 samba; Red Hat Enterprise Linux 6 samba, samba4; Red Hat Enterprise Linux 7 samba; Red Hat Enterprise Linux 8 samba; and 3 more.
Is there a fix for CVE-2026-58216?
A patch was published on 2026-07-29: Samba bug resolved fixed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58216 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58216?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in Samba's KDC kpasswd service within 'source4/kdc/kpasswd-service.c'. The flaw is caused by a miscalculation of the encrypted data length in ASN.1-encoded Kerberos password change requests, where the code fails to subtract the 6-byte header length from the total packet length. An authenticated attacker can exploit this by sending a malformed request, forcing the server to read up to six bytes beyond the allocated buffer. While this typically results in a decryption failure, it can trigger a process crash (SIGSEGV) if the read crosses into unmapped memory. Fixes are available in Samba security releases, and a workaround exists by disabling the kpasswd service via 'kpasswd port = 0' in smb.conf.

Affected products

  • Samba Samba 4.0 and newer
  • Red Hat Enterprise Linux 6 samba, samba4
  • Red Hat Enterprise Linux 7 samba
  • Red Hat Enterprise Linux 8 samba
  • Red Hat Enterprise Linux 9 samba
  • Red Hat Enterprise Linux 10 samba
  • Red Hat OpenShift Container Platform 4 rhcos

Timeline

  • 2026-05-27: disclosed: Initial report to Samba by Tristan Madani
  • 2026-07-30: advisory: NVD and Red Hat published advisory
  • 2026-07-29: patched: Samba bug resolved fixed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.