CVE-2016-2123: samba Heap-based Buffer Overflow
Vulnerability summary
CVE-2016-2123 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in samba. EPSS estimates a 6.23% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 01-11-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
6.23%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
[unknown]1 product
- sambaversions 4.0.0 to 4.5.2
Alpine1 product
- samba≥ 4.0.0, < 4.2.14-r1 | ≥ 4.0.0, < 4.4.5-r2
Debian1 product
- samba< 2:4.5.2+dfsg-2
Samba1 product
- samba≥ 4.0.0, ≤ 4.0.26 | ≥ 4.1.0, ≤ 4.1.23 | ≥ 4.2.0, ≤ 4.2.14 | ≥ 4.3.0, < 4.3.13 | ≥ 4.4.0, < 4.4.8 | ≥ 4.5.0, < 4.5.3
Ubuntu1 product
- samba< 2:4.3.11+dfsg-0ubuntu0.14.04.4 | < 2:4.3.11+dfsg-0ubuntu0.16.04.3
5 vendors · 5 products
