CVE-2026-58216.html:

===========================================================
== Subject:     An authenticated user could possibly crash a KDC process
==
== CVE ID#:     CVE-2026-58216
==
== Versions:    All versions since 4.0
==

== Summary:     A kpasswd packet that contains malformed ASN.1 might cause
                the server to access 6 bytes of unallocated memory. This memory
		is not exposed to the user, but in some circumstances the server
		could crash.

===========================================================

===========
Description
===========

A miscalculation means an ASN.1 structure used in a Kerberos password
change is assumed to be six bytes bigger than it is. This does not
affect ordinary packets (the ASN.1 itself contains the correct size),
but a crafted ANS1 packet could force up to six unallocated bytes to
be read. The usual outcome of this will be a decryption failure and an
error message, but it could make the server process crash.

================== Patch Availability ==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H  5.3

==========
Workaround
==========

Setting the smb.conf option "kpasswd port = 0" will disable the
kpasswd service.

The attack seems quite unreliable in practice, so an attacker might be
observed making thousands of kpasswd attempts before succeeding.
Rate-limiting traffic to the kpasswd port might be useful.

=======
Credits
=======

Originally reported by Tristan Madani (@TristanInSec), Talence Security.

Patch provided by Douglas Bagnall of the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================