CVE-2026-58216

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Samba KDC Password Change Service

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Red Hat, Inc.

Description

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-58216

EUVD

EUVD-2026-51177

Affected Vendors & Products

Vendor	Product	Version / Range
samba	samba	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read flaw in Samba's Kerberos Key Distribution Center's (KDC) password change service. When processing a malformed ASN.1-encoded Kerberos password change request, the Samba server miscalculates the structure size and reads up to six bytes beyond the allocated buffer. This typically causes a harmless decryption failure but can crash the KDC process if unmapped memory is accessed.

Detection Guidance

This vulnerability can be detected by monitoring Samba KDC logs for crashes or errors during Kerberos password change requests. Check for malformed ASN.1 data in kpasswd service logs. Use network traffic analysis tools like Wireshark to inspect kpasswd requests for unusual patterns.

Impact Analysis

An authenticated attacker can exploit this by sending a specially crafted request to crash the KDC process, leading to a denial of service. This disrupts authentication services, potentially locking users out of systems relying on Kerberos for authentication.

Compliance Impact

This vulnerability may impact compliance with standards like GDPR and HIPAA by causing service disruption through denial of service. An attacker could crash the KDC process, leading to authentication failures and potential unauthorized access risks.

Mitigation Strategies

Update Samba to the latest patched version immediately. Disable the kpasswd service if not needed. Restrict network access to the KDC service using firewalls. Monitor KDC processes for crashes and restart them if necessary.

Hi! I’m here to help you understand CVE-2026-58216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70