An out-of-bounds read flaw in Samba’s Kerberos Key Distribution Center password‑change service (kpasswd) allows an attacker who can authenticate to a Samba KDC to send a specially crafted ASN.1‑encoded request. The server miscalculates the structure size and reads up to six bytes beyond a buffer, which normally causes a decryption failure but can trigger a crash when the out‑of‑bounds read hits unmapped memory. The resulting termination of the KDC process leads to a denial of service for clients relying on Kerberos authentication.

Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, all of which run Samba with a Kerberos KDC that includes the kpasswd service. Versions of Samba bundled with these platforms that have not yet been updated to patch the flaw are affected.

The CVSS score of 5.3 indicates a moderate impact, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Although the EPSS score is below 1%, the requirement for an authenticated attacker suggests that exploitation is limited to users who possess valid Kerberos credentials or who can otherwise gain authentication to the Samba server. Rate limiting or disabling the kpasswd service can mitigate the risk until a patch is applied.