CVE-2021-44142: Samba vfs_fruit heap out-of-bounds read/write enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution as root with a high EPSS score and public technical detail, though not currently in CISA KEV.

What it is

Samba's vfs_fruit module mishandles extended file attributes (xattr), allowing out-of-bounds heap reads and writes when specially crafted EAs are processed. The flaw affects Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 when vfs_fruit is configured, and it matters because it can lead to remote code execution as smbd, typically root.

Impact

An attacker with write access to extended file attributes can corrupt heap memory and execute arbitrary code with the privileges of smbd, typically root. This gives full control of the Samba server process and potentially the underlying host.

Attack surface

Reached remotely over SMB against a Samba server with vfs_fruit enabled; the CVSS vector indicates network access with low privileges required and no user interaction. The attacker must be able to write extended file attributes, so some level of authenticated write access to a share is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.73864, 99.45th percentile) and a public ZDI blog details the bug as demonstrated at Pwn2Own Austin, indicating public technical detail and elevated exploitation likelihood. No ransomware group usage is documented in the record.

What to do

• Patch Samba to 4.13.17, 4.14.12, 4.15.5 or later as soon as possible.
• If vfs_fruit is not required, disable or remove it from the Samba configuration.
• Restrict SMB share write access and xattr write permissions to trusted users only.
• Apply vendor updates for affected distributions and appliances (Debian, Ubuntu, Fedora, Red Hat, Synology).
• Monitor Samba security advisories and CERT/CC guidance for follow-up fixes.

Detection

• Review Samba configurations for vfs_fruit usage and inventory unpatched Samba versions.
• Monitor SMB server logs and file system activity for unusual extended attribute writes or crashes in smbd.
• Watch for unexpected smbd process behavior, restarts, or child processes indicative of code execution.
• Use host or network detection to flag exploitation attempts against SMB services on affected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.