Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-58216: Debian Linux: Unprivileged user can escape restricted directory
CVE-2026-58216 · published 3 months ago
Summary
A bug in Debian Linux allows an attacker with limited privileges to break out of a restricted directory, potentially allowing them to access sensitive areas of the system. This could be exploited by a malicious user to gain unauthorized access to the system. To protect against this, update your Debian Linux installation to the latest version.
What to do
- Update debian samba to version 2:4.22.10+dfsg-0+deb13u2.
- Update canonical samba to version 2:4.15.13+dfsg-0ubuntu1.13.
- Update canonical samba to version 2:4.19.5+dfsg-4ubuntu9.7.
- Update canonical samba to version 2:4.23.6+dfsg-1ubuntu2.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat openshift container platform 4 | All versions |
| Debian:11 | debian | samba | All versions |
| Debian:12 | debian | samba | All versions |
| Debian:13 | debian | samba |
< 2:4.22.10+dfsg-0+deb13u2 Fix: upgrade to 2:4.22.10+dfsg-0+deb13u2
|
| Debian:14 | debian | samba | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | samba | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | samba | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | samba | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | samba | All versions |
| Ubuntu:22.04:LTS | canonical | samba |
< 2:4.15.13+dfsg-0ubuntu1.13 Fix: upgrade to 2:4.15.13+dfsg-0ubuntu1.13
|
| Ubuntu:24.04:LTS | canonical | samba |
< 2:4.19.5+dfsg-4ubuntu9.7 Fix: upgrade to 2:4.19.5+dfsg-4ubuntu9.7
|
| Ubuntu:26.04:LTS | canonical | samba |
< 2:4.23.6+dfsg-1ubuntu2.2 Fix: upgrade to 2:4.23.6+dfsg-1ubuntu2.2
|
Original advisory text
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request,...
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
References
- https://security-tracker.debian.org/tracker/CVE-2026-58216 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-58216
- https://bugzilla.redhat.com/show_bug.cgi?id=2502721
- https://www.samba.org/samba/security/CVE-2026-58216.html
- https://bugzilla.samba.org/show_bug.cgi?id=16087
- https://ubuntu.com/security/CVE-2026-58216 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-58216 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8621-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published30 Jul 2026
Updated4 Nov 2026
First seen28 Jul 2026
Sources
DEBIAN-CVE-2026-58216 · OSV
CVE-2026-58216 · NVD
CVE-2026-58216 · MITRE
UBUNTU-CVE-2026-58216 · OSV
Track software like this
Free during beta