DEBIAN-CVE-2026-3238

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-3238
Published: 08 Jun 2026, 09:16
Last modified:21 Jul 2026, 11:15

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Jun 2026, 09:16
Published
Vulnerability first disclosed
21 Jul 2026, 11:15
Last Modified
Vulnerability information updated

Description

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • debian•samba

    all | all | < 2:4.13.13+dfsg-1~deb11u8 | < 2:4.17.12+dfsg-0+deb12u4 | < 2:4.22.8+dfsg-0+deb13u2 | < 2:4.24.3+dfsg-1

References (1)