CVE-2026-3238
Publication date 26 May 2026
Last updated 18 June 2026
Ubuntu priority
Description
A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| samba | 26.04 LTS resolute |
Fixed 2:4.23.6+dfsg-1ubuntu2.1
|
| 25.10 questing |
Fixed 2:4.22.3+dfsg-4ubuntu2.4
|
|
| 24.04 LTS noble |
Fixed 2:4.19.5+dfsg-4ubuntu9.6
|
|
| 22.04 LTS jammy |
Fixed 2:4.15.13+dfsg-0ubuntu1.12
|
|
| 20.04 LTS focal |
Fixed 2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2
|
|
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored end of ESM support, was needs-triage | |
| 14.04 LTS trusty | Ignored changes too intrusive |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
mdeslaur
This issue only affects configurations where the wins server was enabled with the "wins support = Yes" option.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8306-1
- Samba vulnerabilities
- 26 May 2026