CVE-2026-3238 is a high-severity vulnerability affecting the Samba WINS server component on Red Hat Enterprise Linux 10 when configured as an Active Directory Domain Controller. The WINS protocol handlers fail to properly validate specific request types in incoming UDP packets, enabling an unauthenticated remote attacker to trigger a NULL pointer dereference. This causes the WINS service to crash, resulting in a denial of service condition. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

The vulnerability allows unauthenticated remote attackers to cause a denial of service by crashing the WINS service via specially crafted UDP packets. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3238 for current remediation guidance. Since no official fix or workaround is indicated in the advisory content, users should monitor the vendor advisory for updates. Until a patch is available, limiting exposure of the WINS service to untrusted networks may reduce risk.