CVE-2026-58216
Description
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
Statement
Red Hat Product Security has rated this vulnerability as having a Moderate security impact.
Successful exploitation requires an authenticated attacker to craft a malformed ASN.1-encoded Kerberos password change request that precisely triggers the underlying parsing flaw, increasing the attack complexity. The Samba project also notes that the attack is unreliable in practice and an attacker may need to perform numerous kpasswd attempts before successfully causing the service to terminate.
Standard RHEL Server Deployments (Not Affected): Default Red Hat Enterprise Linux (RHEL) deployments are not affected. RHEL does not support the Samba Active Directory Domain Controller (AD DC) role or its integrated Kerberos Key Distribution Center (KDC), including the kpasswd service, where this vulnerability resides.
Samba AD DC Deployments (Affected): Deployments explicitly configured to operate as a Samba Active Directory Domain Controller (server role = active directory domain controller) are affected.
Mitigation
Administrators who do not require the Kerberos password change service may disable it by setting
kpasswd port = 0in
/etc/samba/smb.conf.
Where disabling the service is not practical, rate-limiting access to the kpasswd service may reduce the likelihood of successful exploitation until an updated package can be applied.
Note: Disabling kpasswd port will prevent domain users from changing their Kerberos passwords via the kpasswd protocol until patched.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Acknowledgements
Red Hat would like to thank Tristan Madani (@TristanInSec) (Talence Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
