CVE-2007-2446: Samba smbd NDR parsing heap buffer overflows allow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or interaction required, combined with a very high EPSS score, makes this a top-priority remote code execution risk for exposed Samba services.

What it is

Samba 3.0.0 through 3.0.25rc3 contains multiple heap-based buffer overflows in the NDR parsing code of smbd, reachable through crafted MS-RPC requests. The affected parsing routines include DFSEnum, RFNPCNEX, LsarAddPrivilegesToAccount, NetSetFileSecurity, and LsarLookupSids/LsarLookupSids2. Because these are memory corruption flaws in a network-facing service, they matter for any environment exposing SMB/RPC services.

Impact

A remote attacker can execute arbitrary code in the context of the smbd process, which typically runs with elevated privileges on the host. Successful exploitation can lead to full compromise of the file server and any data or credentials it handles.

Attack surface

The flaw is reached over the network via crafted MS-RPC requests to smbd; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing the Samba SMB/RPC service is potentially reachable.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use, but EPSS is very high (0.773 probability, 99.5th percentile), indicating strong likelihood of exploitation activity. Reference tags are vendor advisories only, so no public exploit code is confirmed by this record.

What to do

• Upgrade Samba to a version later than 3.0.25rc3 that contains the NDR parsing fixes.
• If immediate patching is not possible, restrict network access to SMB/RPC ports (139/445) to trusted hosts only.
• Disable or block unnecessary MS-RPC services and named pipes that are not required for business operations.
• Apply vendor advisories from Apple, HP, and SUSE for bundled or downstream Samba packages.
• Monitor and segment file server networks so a compromised smbd cannot pivot freely.

Detection

• Inspect SMB/RPC traffic for malformed or unusually large NDR requests targeting DFSEnum, RFNPCNEX, LsarAddPrivilegesToAccount, NetSetFileSecurity, or LsarLookupSids operations.
• Monitor smbd process crashes or abnormal terminations, which can indicate heap corruption attempts.
• Alert on unexpected outbound connections or child processes spawned by smbd.
• Review host logs for signs of code execution in the context of the Samba service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.