CVE-2026-4408 | Critical | 9.0 | 2026-05-28 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password s… |
CVE-2026-2340 | Medium | 6.5 | 2026-05-27 | A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files aft… |
CVE-2026-1933 | High | 7.1 | 2026-05-27 | A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authentica… |
CVE-2026-3012 | High | 8.0 | 2026-05-27 | A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate… |
CVE-2026-4480 | Critical | 9.0 | 2026-05-26 | A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command"… |
CVE-2026-29518 | High | 7.0 | 2026-05-20 | Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file write… |
CVE-2026-45232 | Low | 3.1 | 2026-05-20 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows… |
CVE-2026-43620 | Medium | 6.5 | 2026-05-20 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server… |
CVE-2026-43619 | Medium | 6.3 | 2026-05-20 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir… |
CVE-2026-43618 | High | 8.1 | 2026-05-20 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overfl… |
CVE-2026-43617 | Medium | 4.8 | 2026-05-20 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configure… |
CVE-2026-41035 | High | 7.4 | 2026-04-16 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run… |
CVE-2025-0620 | Medium | 4.9 | 2025-06-06 | A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expo… |
CVE-2024-58250 | Critical | 9.3 | 2025-04-22 | The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. |
CVE-2024-12084 | Critical | 9.8 | 2025-01-15 | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in t… |
CVE-2024-12088 | Medium | 6.5 | 2025-01-14 | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server… |
CVE-2024-12087 | Medium | 6.5 | 2025-01-14 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client option… |
CVE-2024-12086 | Medium | 6.1 | 2025-01-14 | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are b… |
CVE-2024-12085 | High | 7.5 | 2025-01-14 | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length… |
CVE-2023-4154 | High | 7.5 | 2023-11-07 | A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Do… |
CVE-2023-42669 | Medium | 6.5 | 2023-11-06 | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability ste… |
CVE-2023-3961 | Critical | 9.1 | 2023-11-03 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba ty… |
CVE-2023-4091 | Medium | 6.5 | 2023-11-03 | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xa… |
CVE-2023-42670 | Medium | 6.5 | 2023-11-03 | A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC se… |
CVE-2023-5568 | Medium | 5.9 | 2023-10-25 | A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of s… |
CVE-2023-3347 | Medium | 5.9 | 2023-07-20 | A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required"… |
CVE-2023-34968 | Medium | 5.3 | 2023-07-20 | A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and dire… |
CVE-2023-34967 | Medium | 5.3 | 2023-07-20 | A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is… |
CVE-2023-34966 | High | 7.5 | 2023-07-20 | An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core un… |
CVE-2022-2127 | Medium | 5.9 | 2023-07-20 | An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the… |
CVE-2023-0922 | Medium | 5.9 | 2023-04-03 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. |
CVE-2023-0614 | Medium | 6.5 | 2023-04-03 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to… |
CVE-2023-0225 | Medium | 4.3 | 2023-04-03 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any ob… |
CVE-2022-45141 | Critical | 9.8 | 2023-03-06 | Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac i… |
CVE-2021-20251 | Medium | 5.9 | 2023-03-06 | A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are… |
CVE-2018-14628 | Medium | 4.3 | 2023-01-17 | An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could… |
CVE-2022-3592 | Medium | 6.5 | 2023-01-12 | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw… |
CVE-2022-3437 | Medium | 6.5 | 2023-01-12 | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decr… |
CVE-2022-42898 | High | 8.8 | 2022-12-25 | PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind… |
CVE-2022-44640 | Critical | 9.8 | 2022-12-25 | Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC). |
CVE-2022-4603 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The m… |
CVE-2022-38023 | High | 8.1 | 2022-11-09 | Netlogon RPC Elevation of Privilege Vulnerability |
CVE-2022-37967 | High | 7.2 | 2022-11-09 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-37966 | High | 8.1 | 2022-11-09 | Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability |
CVE-2022-32743 | High | 7.5 | 2022-09-01 | Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. |
CVE-2022-1615 | Medium | 5.5 | 2022-09-01 | In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. |
CVE-2022-0336 | High | 8.8 | 2022-08-29 | The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database… |
CVE-2022-32746 | Medium | 5.4 | 2022-08-25 | A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resu… |
CVE-2022-32745 | High | 8.1 | 2022-08-25 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segm… |
CVE-2022-32744 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user… |
CVE-2022-32742 | Medium | 4.3 | 2022-08-25 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing s… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2021-3670 | Medium | 6.5 | 2022-08-23 | MaxQueryDuration not honoured in Samba AD DC LDAP |
CVE-2021-20316 | Medium | 6.8 | 2022-08-23 | A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata… |
CVE-2022-29154 | High | 7.4 | 2022-08-02 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The ser… |
CVE-2022-29869 | Medium | 5.3 | 2022-04-28 | cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. |
CVE-2022-27239 | High | 7.8 | 2022-04-27 | In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root priv… |
CVE-2020-25721 | High | 8.8 | 2022-03-16 | Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable S… |
CVE-2021-3738 | High | 8.8 | 2022-03-02 | In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These han… |
CVE-2021-23192 | High | 7.5 | 2022-03-02 | A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker c… |
CVE-2021-44141 | Medium | 4.3 | 2022-02-21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the… |
CVE-2021-44142 | High | 8.8 | 2022-02-21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a N… |
CVE-2020-25722 | High | 8.8 | 2022-02-18 | Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total dom… |
CVE-2020-25719 | High | 7.2 | 2022-02-18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become conf… |
CVE-2020-25718 | High | 8.8 | 2022-02-18 | A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC… |
CVE-2020-25717 | High | 8.1 | 2022-02-18 | A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. |
CVE-2016-2124 | Medium | 5.9 | 2022-02-18 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even i… |
CVE-2021-43566 | Low | 2.5 | 2022-01-11 | All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the serv… |
CVE-2021-3671 | Medium | 6.5 | 2021-10-12 | A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated us… |
CVE-2020-14387 | High | 7.4 | 2021-05-27 | A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attac… |
CVE-2020-27840 | High | 7.5 | 2021-05-12 | A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead… |
CVE-2021-20277 | High | 7.5 | 2021-05-12 | A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of… |
CVE-2021-20254 | Medium | 6.8 | 2021-05-05 | A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a fl… |
CVE-2021-20208 | Medium | 6.1 | 2021-04-19 | A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of th… |
CVE-2020-14318 | Medium | 4.3 | 2020-12-03 | A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and director… |
CVE-2020-14383 | Medium | 6.5 | 2020-12-02 | A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols othe… |
CVE-2020-17049 | Medium | 6.6 | 2020-11-11 | A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos… |
CVE-2020-14323 | Medium | 5.5 | 2020-10-29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this f… |
CVE-2020-14342 | Medium | 4.4 | 2020-09-09 | It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker… |
CVE-2020-1472 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the N… |
CVE-2020-10745 | High | 7.5 | 2020-07-07 | A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote… |
CVE-2020-10730 | Medium | 6.5 | 2020-07-07 | A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Alt… |
CVE-2020-10760 | Medium | 6.5 | 2020-07-06 | A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP use… |
CVE-2020-14303 | High | 7.5 | 2020-07-06 | A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to… |
CVE-2020-10704 | High | 7.5 | 2020-05-06 | A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Control… |
CVE-2020-10700 | Medium | 5.3 | 2020-05-04 | A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a… |
CVE-2019-19344 | Medium | 6.5 | 2020-01-21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5… |
CVE-2019-14907 | Medium | 6.5 | 2020-01-21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then th… |
CVE-2019-14902 | Medium | 5.4 | 2020-01-21 | There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the re… |
CVE-2011-3585 | Medium | 4.7 | 2019-12-31 | Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a… |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2019-14861 | Medium | 5.3 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides admi… |
CVE-2019-14847 | Medium | 4.9 | 2019-11-06 | A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of… |
CVE-2019-14833 | Medium | 5.4 | 2019-11-06 | A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or… |
CVE-2019-10218 | Medium | 6.5 | 2019-11-06 | A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client… |
CVE-2019-10197 | Medium | 6.5 | 2019-09-03 | A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samb… |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2018-16860 | High | 7.5 | 2019-07-31 | A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3… |
CVE-2019-12436 | Medium | 6.5 | 2019-06-19 | Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged se… |
CVE-2019-12435 | Medium | 6.5 | 2019-06-19 | Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management ser… |