CVE-2021-44142 Public exploit High · 8.8 EPSS 73.6%

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple…

Samba · Samba

Summary

The Samba vfs_fruit module, which uses extended file attributes to support Apple SMB clients and Netatalk 3 AFP interoperability, contains out-of-bounds heap read and write flaws in Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 when vfs_fruit is configured. A remote attacker with write access to extended file attributes can craft them to execute arbitrary code with the privileges of smbd, typically root.

Official description · CVE.org

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Breakdown

68.1 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 2 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 36 days after disclosure.

Disclosed21 Feb 2022day 0
Public exploit codePoC-in-GitHub29 Mar 2022+36 days
First seen exploitedVulnCheck KEV evidence25 Jul 2024+2 yrs

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 7 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

5 links, grouped by NVD tag (1 duplicate merged)

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-30995

Public exploitAdvisories link exploit code.

, 30 Oct 2026

73.6%Top 0.53%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.47%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 828 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9947 19.9/20

Threat reports0 reports 0.0/10

Public exploit code3 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses7 pulses 2.0/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total68.1

Record

Published: 21 Feb 2022
Modified: 23 Apr 2025
: CWE-125 Out-of-bounds ReadCWE-787 Out-of-bounds Write
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

What security researchers reported

Also mentioned in 7 community threat pulses (AlienVault OTX)

References

Other 3

third-party-advisory 1

vendor-advisory 1

techniques