Read the docs
TI-2022-14292 Aliases CVE-2022-32746GHSA-hv8p-prvv-v646

Use after free in samba

Priority LOW 27CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

Why it matters now

EPSS 0.01318 70th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—sambaVersions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14—No fix listedCNA
  • samba Vendor— Affected Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*4.3.0 to before 4.14.14; 4.15.0 to before 4.15.9; 4.16.0 to before 4.16.4VulnerableSamba
  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* Versions 4.3.0 to before 4.14.14; 4.15.0 to before 4.15.9; 4.16.0 to before 4.16.4 Vulnerable ·Samba

Remediation

Red Hat 2 advisories

  • RHSA-2022:8318 Released 2022-11-15 · Red Hat rating Moderate
    libldb security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 9) libldb-devel-2.5.2-1.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) ldb-tools-2.5.2-1.el9, libldb-2.5.2-1.el9, python3-ldb-2.5.2-1.el9
  • RHSA-2022:7730 Released 2022-11-08 · Red Hat rating Moderate
    libldb security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) python-ldb-devel-common-2.5.2-2.el8, python3-ldb-devel-2.5.2-2.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) ldb-tools-2.5.2-2.el8, libldb-2.5.2-2.el8, libldb-devel-2.5.2-2.el8 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2022:7730
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2022:8318
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2022:7730
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2022:8318
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-32746
  2. 2026-10-03 Alias added: GHSA-hv8p-prvv-v646

References

Patch 1

Advisory 1

  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-05139 Code injection in samba KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-00210 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x… CVSS 2.0HIGH 10.0
  • TI-2003-00081 Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in… CVSS 2.0HIGH 10.0
  • TI-2003-00185 Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before… CVSS 2.0HIGH 10.0
  • TI-2007-02362 Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through… CVSS 2.0HIGH 10.0
See all 215 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences