CVE-2026-58216.html:
===========================================================
== Subject: An authenticated user could possibly crash a KDC process
==
== CVE ID#: CVE-2026-58216
==
== Versions: All versions since 4.0
==
== Summary: A kpasswd packet that contains malformed ASN.1 might cause
the server to access 6 bytes of unallocated memory. This memory
is not exposed to the user, but in some circumstances the server
could crash.
===========================================================
===========
Description
===========
A miscalculation means an ASN.1 structure used in a Kerberos password
change is assumed to be six bytes bigger than it is. This does not
affect ordinary packets (the ASN.1 itself contains the correct size),
but a crafted ANS1 packet could force up to six unallocated bytes to
be read. The usual outcome of this will be a decryption failure and an
error message, but it could make the server process crash.
================== Patch Availability ==================
Patches addressing this issue have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.
==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H 5.3
==========
Workaround
==========
Setting the smb.conf option "kpasswd port = 0" will disable the
kpasswd service.
The attack seems quite unreliable in practice, so an attacker might be
observed making thousands of kpasswd attempts before succeeding.
Rate-limiting traffic to the kpasswd port might be useful.
=======
Credits
=======
Originally reported by Tristan Madani (@TristanInSec), Talence Security.
Patch provided by Douglas Bagnall of the Samba team.
==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================