CVE-2026-3238: Samba WINS Server NULL Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-3238 is a NULL pointer dereference (CWE-476) in Samba's WINS server component. The WINS protocol packet handlers fail to properly validate incoming UDP packets for certain request types when Samba operates as an Active Directory Domain Controller. This validation gap allows an unauthenticated remote attacker to craft malicious packets that dereference a NULL pointer, crashing the WINS service and causing denial of service. The vulnerability requires network access but no privileges or authentication.

Business impact

A successful attack renders the WINS service unavailable, disrupting name resolution services that depend on WINS in environments where Samba acts as an AD Domain Controller. For organizations relying on WINS for legacy name resolution or in hybrid AD environments, this denial of service can disrupt user connectivity, authentication, and resource discovery. The impact is limited to availability; there is no data theft or lateral movement risk from this flaw alone.

Affected systems

Samba installations configured to run as an Active Directory Domain Controller with the WINS server component enabled are affected. The vulnerability is specific to the WINS protocol handler within Samba's AD DC role. Organizations should inventory Samba-based domain controllers and verify whether WINS is actively deployed in their environment. Non-AD Samba file servers and Samba instances not running WINS are not affected.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH) reflecting high exploitability: the attack requires no authentication, no user interaction, and can be executed remotely via the network. However, the attack surface is limited to systems running Samba as an AD DC with WINS enabled and accessible from the attacker's network segment. Internal network access is typically required unless WINS is exposed on external interfaces (an uncommon misconfiguration).

Remediation

Apply security patches from Samba as soon as they become available. Verify the vendor advisory for patched version numbers and deployment guidance. As a temporary mitigation, restrict UDP access to WINS ports (typically 137–139) at the network boundary and firewall level, limiting exposure to trusted networks only. Organizations not using WINS should disable the WINS server component in Samba configuration. Monitor WINS service logs for crashes or anomalous traffic patterns.

Patch guidance

Consult the official Samba security advisory for the exact patched version numbers and apply updates according to your deployment model (source compilation, package manager, or appliance firmware). Test patches in a non-production environment first to verify compatibility with existing AD integration and replication. After patching, restart the Samba service and confirm WINS functionality is restored and stable.

Detection guidance

Monitor Samba WINS service logs and system logs for unexpected process crashes (segfaults) or service restarts. Network-based detection can identify suspicious UDP traffic to WINS ports with malformed or unusual packet structures; establish baseline traffic patterns and alert on deviations. Implement process monitoring and alerting for abnormal termination of the Samba WINS daemon. Review packet captures for UDP packets sent to WINS ports from unauthorized or unexpected sources.

Why prioritize this

Although CVE-2026-3238 is rated HIGH and exploitable without authentication, prioritization depends on your environment. Organizations running Samba as an AD DC with WINS enabled should treat this as urgent; others can schedule remediation during normal maintenance windows. The lack of confidentiality or integrity impact limits business severity, but denial of service to core directory services warrants prompt attention in AD-dependent environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a remotely exploitable NULL pointer dereference with no authentication barrier and high attack complexity of Low. The impact is confined to availability (service crash), resulting in a less severe rating than vulnerabilities affecting confidentiality or enabling code execution. Organizations should weigh this score against their reliance on Samba WINS services and network exposure.

Frequently asked questions