CVE-2021-44142: RCE in Samba vfs_fruit via xattr

Heap OOB in Samba vfs_fruit RCE with root privileges (CVSS 8.8). Versions <4.13.17, <4.14.12, <4.15.5.

CVE-2021-44142 is a heap out-of-bounds vulnerability affecting Samba's vfs_fruit module. This module provides enhanced compatibility with Apple SMB clients and interoperability with Netatalk 3 AFP servers. The flaw allows unauthorized read and write operations in heap memory via specially crafted extended file attributes (xattr). A remote attacker with write access to xattr can execute arbitrary code with smbd daemon privileges, typically root.

The vulnerability has a CVSS score of 8.8 and is classified as high severity. It was officially disclosed on February 21, 2022 (NVD). On October 31, 2026, a signal from GitHub identifies public repositories claiming to contain educational demos related to CVE-2021-44142, indicating renewed interest in this flaw from the security community and researchers.

Administrators must verify whether Samba is installed with vfs_fruit enabled. Vulnerable versions include all releases prior to 4.13.17, 4.14.12, and 4.15.5. It is essential to update Samba to the patched versions. Verify in your environment that write access to xattr is restricted according to corporate policy. Disabling the vfs_fruit module if not strictly necessary reduces the attack surface.

At a glance

What: Heap out-of-bounds read/write in Samba vfs_fruit module via extended file attributes (xattr). Allows arbitrary code execution with smbd daemon privileges (typically root).
Severity: CVSS 8.8 (high). Requires remote access with write permissions on xattr.
Affected versions: Samba <4.13.17, <4.14.12, <4.15.5 with vfs_fruit configured.
Fix: Update to Samba 4.13.17, 4.14.12, 4.15.5 or later. Official patches available from February 21, 2022.
Status: CVE published 21/02/2022. October 31, 2026 GitHub signals indicate public educational demos; no active exploitation confirmed from verified sources.
Action: Inventory Samba installations with vfs_fruit enabled. Apply patches within two months. Review xattr ACLs. Disable module if not business-critical.

Sources: NVD, CVE-2021-44142

← All articles