CVE-2022-2127Medium· 5.9▾ SunlitAn out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies h…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.7%
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)sambasamba4sambasambaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4480Critical· 9.0Samba: samba: remote code execution in printing subsystem via unescaped job description
CVE-2026-120830High· 7.4Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
CVE-2026-115456Low· 3.7Gcc: out-of-bounds read in std::from_chars
CVE-2026-120740Low· 2.0Hivex: hivex: denial of service via out-of-bounds read in big-data block processing
CVE-2026-118475Low· 3.6Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk
CVE-2026-112922Low· 3.3Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading