CVE-2017-14746

critical

Published 2017-11-27 · Modified 2026-05-13

CVSS v3

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

7.5

VIR risk

9.8

Description

Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.

Exploit likelihood

97%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-14746

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-14746.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://www.samba.org/samba/security/CVE-2017-14746.html

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201712-1

OS	Version	Status	Fixed in
arch		fixed	`4.7.3-1`
sles		affected
debian	8.0	affected
debian	9.0	affected
ubuntu	14.04	affected
ubuntu	16.04	affected
ubuntu	17.04	affected
ubuntu	17.10	affected
rhel	6.0	affected
rhel	7.0	affected
debian	bookworm	fixed	`2:4.7.1+dfsg-2`
debian	bullseye	fixed	`2:4.7.1+dfsg-2`
debian	forky	fixed	`2:4.7.1+dfsg-2`
debian	sid	fixed	`2:4.7.1+dfsg-2`
debian	trixie	fixed	`2:4.7.1+dfsg-2`

Vendor	Product	Versions	Fixed
samba	samba	`{"startIncluding":"4.0.0","endExcluding":"4.5.0"}`	`4.5.0`

CWE-416

Verify integrity in audit chain (admin only). AS-IS.