CVE-2026-3238
Advisory lineage Upstream: 0 Downstream: 9
Awaiting Analysis
Published: 08 Jun 2026, 07:34
Last modified:15 Jul 2026, 01:08
Vulnerability Summary
Overall Risk (default)
medium
31/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
2.67% LOW
3% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
08 Jun 2026, 07:34
Published
Vulnerability first disclosed
15 Jul 2026, 01:08
Last Modified
Vulnerability information updated
Description
A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 2.67%• Percentile: 84%
Techniques & Countermeasures
- CWE-476•NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.