Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Samba 4.18.3-2 password change can cause crash
published 3 months ago
Summary
The Samba server version 4.18.3-2 can crash when it receives a malformed password‑change request. An attacker who can log in could send specially crafted data that makes the server read beyond its memory, stopping the password‑change service and denying users the ability to change passwords. Apply the latest Samba updates or patches and restrict who can send password‑change requests to prevent this disruption.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | samba | <= 4.18.3-2 |
Original advisory text
CVE-2026-58216 affecting package samba 4.18.3-2
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
References
Timeline
Published30 Jul 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-94169 · OSV
Track software like this
Free during beta