A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.
-------- Forwarded Message -------- Date: Tue, 26 May 2026 14:29:50 +0200 Reply-To: Stefan Metzmacher <metze () samba org> Release Announcements ---------------------
This is a security release in order to address the following defects:
o CVE-2026-1933: Missing access checks on reparse point operations
On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for.
https://www.samba.org/samba/security/CVE-2026-1933.html
o CVE-2026-2340: WORM vfs module does not block overwrites
The WORM (Write-Once, Read Many) vfs module is supposed to lock write access to shared files, so they cannot be altered after initial writes. It was allowing files to be overwritten by renaming a newly created file over a protected file.
https://www.samba.org/samba/security/CVE-2026-2340.html
o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification
To bootstrap a certificate chain a domain member must fetch a certificate without TLS. It was trusting HTTP for this when a more secure encrypted LDAP channel was also available.
https://www.samba.org/samba/security/CVE-2026-3012.html
o CVE-2026-3238: Denial of service against AD DC WINS server
The WINS server component of the Active Directory Domain controller code in Samba is vulnerable to a NULL pointer dereference and crash caused by a unauthenticated UDP packet.
https://www.samba.org/samba/security/CVE-2026-3238.html server "check password script" that has the %u substitution character are vulnerable to a remote code execution.
https://www.samba.org/samba/security/CVE-2026-4408.html
o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem
Samba print servers with a "print command" that has the %J substitution character are vulnerable to a Remote Code Execution.
https://www.samba.org/samba/security/CVE-2026-4480.html
Changes -------
o Douglas Bagnall <douglas.bagnall () catalyst net nz> BUG 15997: CVE-2026-2340 BUG 16003: CVE-2026-3012 BUG 16033: CVE-2026-4480 BUG 16034: CVE-2026-4408
o Pavel Kohout <pavel () aisle com> BUG 15997: CVE-2026-2340
o Volker Lendecke <vl () samba org> BUG 15992: CVE-2026-1933 BUG 16012: CVE-2026-3238
o Stefan Metzmacher <metze () samba org> BUG 15992: CVE-2026-1933 BUG 16033: CVE-2026-4480 BUG 16034: CVE-2026-4408 has Homedir / In passwd
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/
The release notes are available online at:
https://www.samba.org/samba/history/samba-4.24.3.html https://www.samba.org/samba/history/samba-4.23.8.html https://www.samba.org/samba/history/samba-4.22.10.html
Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)
--Enjoy The Samba Team
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Samba file servers and classic (non-AD) domain controllers offer the SamValidatePasswordChange and SamValidatePasswordReset RPC services on the SAMR DCE/RPC service when running over NCACNIPTCP. Both services pass a username and password to the "check password script" that can be configured in smb.conf.
If the "check password script" is configured with the %u substitution character, the client-controlled username is passed to the "check password script" without escaping shell meta-characters, leading to a remote command execution vulnerability.
This is a non-standard configuration in several ways:
It affects Samba file servers and classic (non-AD) domain controllers that have the "check password script" configured with the %u substitution character. Active Directory Domain Controllers are not affected, they do not expand the username via the %u substitution character.
The problem is much less dangerous if %u has single quotes directly around it, e.g. '%u', but it's still possible to inject command line options.
Standard Samba file servers and classic domain controllers are also only affected if the samba-dcerpcd service is started as a system service, which can only happen if "rpc start on demand helpers" is set to the non-default setting "no". In the default configuration for DCE/RPC, smbd starts the samba-dcerpcd in a way that makes the vulnerable code inaccessible.
On 07/04/2026 4:10 pm, Douglas Bagnall wrote: On 06/04/2026 2:53 pm, Douglas Bagnall via samba-technical wrote: This is a heads-up that there will be Samba security updates for 4.22, 4.23, and 4.24 on Thursday, April 9, 2026. Please make sure that your Samba servers will be updated soon after the release! Release is still Thursday 9 April. Sorry again. The release has been postponed because we found an issue in one of the fixes.
We will announce a new date as soon as possible.
Douglas
I was a little inaccurate in this message, sorry.
Below I have amended the impacted components to reflect that one of the bad ones requires an unusual configuration, and one of the AD bugs affects domain members, not the DC.
On 06/04/2026 2:53 pm, Douglas Bagnall via samba-technical wrote: This is a heads-up that there will be Samba security updates for 4.22, 4.23, and 4.24 on Thursday, April 9, 2026. Please make sure that your Samba servers will be updated soon after the release!
Impacted components: - File Services, CVSS 10.0, affecting some configurations - File Services, CVSS 10.0, affecting some configurations - File Services, CVSS 7.1 affecting some configurations - File Services, CVSS 6.5 affecting uncommon configurations - AD DC CVSS 8.0, affecting some configurations - AD DC CVSS 7.5, affecting uncommon configurations> Impacted components: - File Services, CVSS 10.0, affecting some configurations - File Services, CVSS 10.0, affecting uncommon configurations - File Services, CVSS 7.1 affecting some configurations - File Services, CVSS 6.5 affecting uncommon configurations - Domain members CVSS 8.0, affecting some configurations - AD DC CVSS 7.5, affecting uncommon configurations
Release is still Thursday 9 April.
Douglas
This is a heads-up that there will be Samba security updates for 4.22, 4.23, and 4.24 on Thursday, April 9, 2026. Please make sure that your Samba servers will be updated soon after the release!
Impacted components: - File Services, CVSS 10.0, affecting some configurations - File Services, CVSS 10.0, affecting some configurations - File Services, CVSS 7.1 affecting some configurations - File Services, CVSS 6.5 affecting uncommon configurations - AD DC CVSS 8.0, affecting some configurations - AD DC CVSS 7.5, affecting uncommon configurations
cheers, Douglas Bagnall Samba Team and Catalyst IT
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
A flaw was found in Samba’s vfsworm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Samba: group policy certificate enrollment uses http:// without validation
Samba: Missing access check on reparse point operations
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
A flaw was found in Samba
A flaw was found in Samba
A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etcro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
All versions of Samba starting with 4.21.0 are vulnerable to a improper authorization issue. smbd does not pick up group membership changes when re-authenticating an expired SMB session.
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
A delegated administrator who can create objects in Active Directory, can write to all attributes in that new object, including after the object is created because they own the object. This includes some security-sensitive attributes (less in Samba that in Windows).
Because these rights are due to there being no ACL at creation time and later being the nebulous 'creator owner', the implication that the delegated administrator retains significant rights may not be well understood.
Behaviour removing the implicit rights of creating users to write to all attributes is off by default in Samba and Windows (see CVE-2021-42291 )
(As mentioned in the bug, we developed some other protections for this that landed in the other CVEs, which is why this one didn't get the full security notice treatment).
The details of how to turn this protection on are at: https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dallocvalueforkey() function, which returns the object associated with a key, a caller may trigger a crash in tallocgetsize() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Netlogon RPC Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.