VulnSocial

CVE-2026-3238General

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-476

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-06-08)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-28: 1Mentions · 2026-06-08: 2Patch / Workaround · 2026-06-08: 1Technical Details · 2026-05-28: 1Technical Details · 2026-06-08: 205-2806-08
Signal classification3 categories
General
133.3%
Disclosure
133.3%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-281
General1
2026-06-082
Disclosure1Patch1
Full discourse3 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-3238 - Unauthenticated remote DoS in Samba AD DC via WINS NULL pointer dereference. CVSS 7.5. Mitigate by restricting WINS access or disabling unnecessary WINS. #CVE #Samba #infosec #CyberCommunity #CyberCrimeAwareness More FREE CVES and Patches: https://www.valtersit.com/cve/CVE-2026-3238/

    Post summary

    CVE-2026-3238 is a Samba AD DC DoS vulnerability; the post lists technical details, a CVSS score, and mitigations that limit or disable WINS, with a hyperlink to related patches.

    0000073
    921 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-3238 Unauthenticated Remote Denial of Service in Samba WINS Server Active Directory Domain Controller https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3238

    Post summary

    A new denial‑of‑service flaw (CVE‑2026‑3238) affecting Samba WINS Server in Active Directory Domain Controllers has been disclosed, with limited technical detail and no PoC or exploit mentioned.

    0000043
    4.0K followersView on X
  • Open Source Security mailing list@oss_security
    General

    Samba CVE-2026-3238: DoS against AD DC WINS server CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem

    Post summary

    The text simply lists three Samba CVEs with basic impact descriptions, lacking any additional details about exploits, patches, or active use.

    00000171
    4.6K followersView on X

Explore more

Back to dashboard