CVE-2019-12436: Null Pointer Dereference
Published Jun 19, 2019
·Updated
Last updated 25 August 2025
Other sources
Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit.
— Launchpad
Affected Software
3 affected componentsFixes available
Samba Samba>=4.10.0<4.10.5
Canonical Ubuntu Linux=19.04
debian/samba
2:4.13.13+dfsg-1~deb11u62:4.13.13+dfsg-1~deb11u72:4.17.12+dfsg-0+deb12u32:4.17.12+dfsg-0+deb12u12:4.22.6+dfsg-0+deb13u12:4.23.5+dfsg-1
Event History
Jun 19, 2019
CVE Published
via MITRE·12:00 PM
Data Sourced
via MITRE·12:00 PM
Description
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·10:41 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:42 PM
Description
Data Sourced
via Debian·10:42 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-12436?
CVE-2019-12436 is classified as a medium severity vulnerability due to its potential to cause a Denial of Service in affected Samba versions.
2
How do I fix CVE-2019-12436?
To fix CVE-2019-12436, upgrade Samba to version 4.10.5 or later on your system.
3
Which versions of Samba are affected by CVE-2019-12436?
Samba versions 4.10.0 to 4.10.4 are affected by CVE-2019-12436.
4
Can CVE-2019-12436 be exploited remotely?
CVE-2019-12436 can be exploited remotely by an attacker who has directory read access.
5
What type of attack does CVE-2019-12436 facilitate?
CVE-2019-12436 facilitates a Denial of Service attack on an Active Directory LDAP server.