OESA-2026-3296 (CVE-2026-58216)

Vulnerability from osv_openeuler – Published: 2026-08-07 02:44 – Updated: 2026-08-07 02:44 – Source website
VLAI
Summary
samba security update
Details

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.(CVE-2026-58216)

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.(CVE-2026-58218)

Samba is an open-source implementation of file sharing and printing services for communication between Linux/Unix and Windows systems. CVE-2026-58221 is a security vulnerability in Samba affecting versions before 4.22.10.(CVE-2026-58221)

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.(CVE-2026-58222)

An undisclosed vulnerability exists in Samba affecting versions before 4.22.10.(CVE-2026-58224)

A security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability details have not been publicly disclosed.(CVE-2026-6949)

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ctdb-4.19.3-10.oe2403sp4.aarch64.rpm",
          "libsmbclient-4.19.3-10.oe2403sp4.aarch64.rpm",
          "libsmbclient-devel-4.19.3-10.oe2403sp4.aarch64.rpm",
          "libwbclient-4.19.3-10.oe2403sp4.aarch64.rpm",
          "libwbclient-devel-4.19.3-10.oe2403sp4.aarch64.rpm",
          "python3-samba-4.19.3-10.oe2403sp4.aarch64.rpm",
          "python3-samba-dc-4.19.3-10.oe2403sp4.aarch64.rpm",
          "python3-samba-test-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-client-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-client-libs-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-common-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-common-tools-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-dc-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-dc-bind-dlz-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-dc-libs-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-dc-provision-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-debuginfo-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-debugsource-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-devel-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-help-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-krb5-printing-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-libs-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-test-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-tools-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-usershares-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-winbind-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-winbind-clients-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-winbind-krb5-locator-4.19.3-10.oe2403sp4.aarch64.rpm",
          "samba-winbind-modules-4.19.3-10.oe2403sp4.aarch64.rpm"
        ],
        "noarch": [
          "samba-pidl-4.19.3-10.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "samba-4.19.3-10.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "ctdb-4.19.3-10.oe2403sp4.x86_64.rpm",
          "libsmbclient-4.19.3-10.oe2403sp4.x86_64.rpm",
          "libsmbclient-devel-4.19.3-10.oe2403sp4.x86_64.rpm",
          "libwbclient-4.19.3-10.oe2403sp4.x86_64.rpm",
          "libwbclient-devel-4.19.3-10.oe2403sp4.x86_64.rpm",
          "python3-samba-4.19.3-10.oe2403sp4.x86_64.rpm",
          "python3-samba-dc-4.19.3-10.oe2403sp4.x86_64.rpm",
          "python3-samba-test-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-client-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-client-libs-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-common-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-common-tools-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-dc-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-dc-bind-dlz-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-dc-libs-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-dc-provision-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-debuginfo-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-debugsource-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-devel-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-help-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-krb5-printing-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-libs-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-test-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-tools-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-usershares-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-vfs-glusterfs-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-winbind-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-winbind-clients-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-winbind-krb5-locator-4.19.3-10.oe2403sp4.x86_64.rpm",
          "samba-winbind-modules-4.19.3-10.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "samba",
        "purl": "pkg:rpm/openEuler/samba\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.3-10.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read flaw was found in Samba\u0026apos;s Kerberos Key Distribution Center\u0026apos;s (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.(CVE-2026-58216)\n\nA flaw was found in Samba\u0026apos;s internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.(CVE-2026-58218)\n\nSamba is an open-source implementation of file sharing and printing services for communication between Linux/Unix and Windows systems. CVE-2026-58221 is a security vulnerability in Samba affecting versions before 4.22.10.(CVE-2026-58221)\n\nA security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the \u0026quot;msKds-RootKeyData\u0026quot; attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.(CVE-2026-58222)\n\nAn undisclosed vulnerability exists in Samba affecting versions before 4.22.10.(CVE-2026-58224)\n\nA security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability details have not been publicly disclosed.(CVE-2026-6949)",
  "id": "OESA-2026-3296",
  "modified": "2026-08-07T02:44:45Z",
  "published": "2026-08-07T02:44:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3296"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58216"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58218"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58221"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58222"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58224"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6949"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "samba security update",
  "upstream": [
    "CVE-2026-58216",
    "CVE-2026-58218",
    "CVE-2026-58221",
    "CVE-2026-58222",
    "CVE-2026-58224",
    "CVE-2026-6949"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.