CVE-2007-2446
CriticalPublic exploitMultiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3)…
Published May 14, 2007 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2007-2446
Key Facts
Patch immediately- CVE-2007-2446 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Samba, rootio-samba, samba-client (oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 78% probability of exploitation in the next 30 days.
- Fixed versions are available, including cifs-utils 6.13-1.3, cifs-utils-devel 6.13-1.3, ctdb 4.14.6+git.182.2205d5224e3-1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
78%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2007-2446 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Affected Products
137 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SambaSamba | 3.0.0, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.14a | 3.0.25-1 |
| rootio-sambarootio | See advisory | 3.0.25-1 |
| samba-clientoracle | See advisory | 3.0.23c-2.el5.2.0.2 |
| samba-commonoracle | See advisory | 3.0.23c-2.el5.2.0.2 |
| samba-swatoracle | See advisory | 3.0.23c-2.el5.2.0.2 |
Patched Releases
cifs-utils
6.13-1.3
cifs-utils-devel
6.13-1.3
ctdb
4.14.6+git.182.2205d5224e3-1.1
ctdb-pcp-pmda
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-binding0
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-binding0-32bit
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-devel
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-samr-devel
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-samr0
4.14.6+git.182.2205d5224e3-1.1
libdcerpc-samr0-32bit
4.14.6+git.182.2205d5224e3-1.1
libdcerpc0
4.14.6+git.182.2205d5224e3-1.1
libdcerpc0-32bit
4.14.6+git.182.2205d5224e3-1.1
libndr-devel
4.14.6+git.182.2205d5224e3-1.1
libndr-krb5pac-devel
4.14.6+git.182.2205d5224e3-1.1
libndr-krb5pac0
4.14.6+git.182.2205d5224e3-1.1
libndr-krb5pac0-32bit
4.14.6+git.182.2205d5224e3-1.1
libndr-nbt-devel
4.14.6+git.182.2205d5224e3-1.1
libndr-nbt0
4.14.6+git.182.2205d5224e3-1.1
libndr-nbt0-32bit
4.14.6+git.182.2205d5224e3-1.1
libndr-standard-devel
4.14.6+git.182.2205d5224e3-1.1
libndr-standard0
4.14.6+git.182.2205d5224e3-1.1
libndr-standard0-32bit
4.14.6+git.182.2205d5224e3-1.1
libndr1
4.14.6+git.182.2205d5224e3-1.1
libndr1-32bit
4.14.6+git.182.2205d5224e3-1.1
libnetapi-devel
4.14.6+git.182.2205d5224e3-1.1
Timeline
Publicly disclosed
May 14, 2007
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- advisoryRHSA-2007:0354
- advisory25232
- advisory25241
- advisory25246
- advisory25251
FAQ
Common Questions.
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege…
Affected: Samba versions 3.0.0, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.14a; rootio-samba; samba-client (oracle), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including cifs-utils 6.13-1.3, cifs-utils-devel 6.13-1.3, ctdb 4.14.6+git.182.2205d5224e3-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2007-2446 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo