{"id":"AZL-94169","summary":"CVE-2026-58216 affecting package samba 4.18.3-2","details":"An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.","modified":"2026-08-30T05:24:52Z","published":"2026-07-30T16:17:14Z","upstream":["CVE-2026-58216"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58216"}],"affected":[{"package":{"name":"samba","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/samba"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.18.3-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94169.json"}}],"schema_version":"1.9.0"}