CVE-2026-3238CWE-476

CVE-2026-3238

High · published June 8, 2026

CVSS v3.1
7.5
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02023 · 80.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-06-08T13:16Z
References (6)
https://access.redhat.com/security/cve/CVE-2026-3238 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2486176 · [email protected]https://www.samba.org/samba/security/CVE-2026-3238.html · [email protected]https://access.redhat.com/security/cve/CVE-2026-3238 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2486176 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3238.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 08 JUN 07:34Z
    Samba: denial of service against ad dc wins server
    cvelistv5