CVE-2026-58216 Details
Description
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
A vulnerability allowing an out-of-bounds read has been identified in Samba's Kerberos Key Distribution Center (KDC) password change service. This flaw arises when the server processes malformed ASN.1-encoded password change requests, leading to a miscalculation of the data structure size. As a result, the server attempts to read up to six bytes beyond the allocated buffer. While this typically causes a harmless decryption error, it can crash the KDC process if the out-of-bounds read accesses unmapped memory. An authenticated attacker can exploit this by sending a specially crafted kpasswd request with distorted ASN.1 data, causing the KDC process to terminate and creating a denial-of-service condition.
Users can disable the kpasswd service by setting 'kpasswd port = 0' in the '/etc/samba/smb.conf' file. However, this will prevent domain users from changing their Kerberos passwords via the kpasswd protocol until the issue is patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |