An out-of-bounds read vulnerability exists in Samba's Kerberos KDC kpasswd service on Red Hat Enterprise Linux 10. When handling malformed ASN.1-encoded Kerberos password change requests, the Samba server miscalculates the structure size and reads up to six bytes beyond the allocated buffer. This typically causes a decryption failure but can crash the KDC process if unmapped memory is accessed. An authenticated attacker can exploit this by sending crafted kpasswd requests, potentially causing denial of service through KDC process termination. The attack complexity is high and unreliable, requiring multiple attempts. Red Hat rates this vulnerability as Moderate impact with a CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Successful exploitation results in denial of service by crashing the Kerberos KDC process, disrupting the password change service. There is no confidentiality or integrity impact reported. The attack requires authentication and has high complexity, making exploitation difficult and unreliable. The availability impact is high due to potential service termination.

Administrators can mitigate this vulnerability by disabling the Kerberos password change service (kpasswd) via setting 'kpasswd port = 0' in /etc/samba/smb.conf, which prevents domain users from changing passwords via kpasswd until patched. If disabling is not feasible, rate-limiting access to the kpasswd service may reduce exploitation likelihood. No official patch is currently confirmed; check the Red Hat advisory for updates. Red Hat rates the vulnerability as Moderate and notes the attack is unreliable and complex.