What’s Vulnerable › Vulnerabilities

CVE-2017-14746

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-27 · updated 2026-06-17
• Weakness: CWE-416

Description

Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.04, 17.10
• Debian Linux: 8.0, 9.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• Samba: from 4.0.0 before 4.5.0; from 4.5.0 before 4.5.15; from 4.6.0 before 4.6.11; from 4.7.0 before 4.7.3 — fixed in 4.5.0, 4.5.15, 4.6.11, 4.7.3

How to fix

Upgrade to a fixed version: Samba 4.5.0, 4.5.15, 4.6.11, 4.7.3. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/101907
• http://www.securitytracker.com/id/1039856
• http://www.ubuntu.com/usn/USN-3486-1
• https://access.redhat.com/errata/RHSA-2017:3260
• https://access.redhat.com/errata/RHSA-2017:3261
• https://access.redhat.com/errata/RHSA-2017:3278
• https://security.gentoo.org/glsa/201805-07
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us
• https://www.debian.org/security/2017/dsa-4043
• https://www.samba.org/samba/security/CVE-2017-14746.html
• https://www.synology.com/support/security/Synology_SA_17_72_Samba
• http://www.securityfocus.com/bid/101907

Get alerted when CVE-2017-14746 or the next vulnerability affects your stack