CVE-2026-58216

Name	CVE-2026-58216
Description	An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6401-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
samba (PTS)	bullseye	2:4.13.13+dfsg-1~deb11u6	vulnerable
	bullseye (security)	2:4.13.13+dfsg-1~deb11u8	vulnerable
	bookworm, bookworm (security)	2:4.17.12+dfsg-0+deb12u4	vulnerable
	trixie	2:4.22.10+dfsg-0+deb13u1	vulnerable
	trixie (security)	2:4.22.10+dfsg-0+deb13u2	fixed
	forky	2:4.24.5+dfsg-1	fixed
	sid	2:4.24.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
samba	source	trixie	2:4.22.10+dfsg-0+deb13u2		DSA-6401-1
samba	source	(unstable)	2:4.24.5+dfsg-1

Notes

[bookworm] - samba <postponed> (minor issue; DoS)
[bullseye] - samba <postponed> (minor issue; DoS)
https://www.samba.org/samba/security/CVE-2026-58216-advisory.html