Vulnerability Description
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | <= 4.2 |
| Redhat | Enterprise Linux | 6.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2026-58224Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2502720Issue TrackingThird Party Advisory
- https://bugzilla.samba.org/show_bug.cgi?id=16085Issue TrackingMitigationVendor Advisory
- https://www.samba.org/samba/security/CVE-2026-58224-advisory.htmlMailing ListVendor Advisory
FAQ
What is CVE-2026-58224?
CVE-2026-58224 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field le...
How severe is CVE-2026-58224?
CVE-2026-58224 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58224?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Redhat Enterprise Linux.