Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3738

28
FAUCET Score

CVE-2021-3738 is a use-after-free vulnerability in Samba's DCE/RPC implementation, affecting Samba versions. It arises when shared database handles within an association group lead to an invalid user credential state upon connection termination. This flaw carries a high CVSS score of 8.8, indicating a critical risk due to its network-based attack vector, low attack complexity, and potential for high impact on confidentiality, integrity, and availability. While a crash is the most likely outcome, there's a possibility of privilege escalation. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 4.0.0, < 4.13.14CPE matchmatch criteria
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
>= 4.14.0, < 4.14.10CPE matchmatch criteria
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
>= 4.15.0, < 4.15.2CPE matchmatch criteria
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.92%
Probability of exploitation in next 30 days
EPSS Percentile
77.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0192 is in the 76th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

microsoftpatch availablevia msrc
Product: 16864-17084Fixed in: 4.18.3-1
microsoftpatch availablevia msrc
Product: azl3 samba 4.18.3-1 on Azure Linux 3.0Fixed in: 4.18.3-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 4.18.3-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 4.18.3-1

Vendor Advisories (3)

microsoft2024-Oct/CVE-2021-3738

CVE-2021-3738

Oct 8, 2024
microsoft2022-Mar/CVE-2021-3738Important

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared the user credentials state was only pointed at and when one connection within that association group ended the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

Mar 8, 2022
redhatCVE-2021-3738Moderate

samba: Use after free in Samba AD DC RPC server

Nov 9, 2021

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
bugzilla.samba.org / show_bug.cgi
Issue TrackingPatchVendor Advisory
security.gentoo.org / glsa/202309-06
samba.org / samba/security/CVE-2021-3738.html
Vendor Advisory