CVE-2021-23192: Samba

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

Affected products

• Samba Samba: from 4.10.0, before 4.13.14 (fixed in 4.13.14); from 4.14.0, before 4.14.10 (fixed in 4.14.10); from 4.15.0, before 4.15.2 (fixed in 4.15.2)

Published 2022-03-02. Last modified 2026-06-17.