How severe is CVE-2020-10730?

CVE-2020-10730 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2020-10730 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-10730?

CVE-2020-10730 primarily affects Redhat Storage. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-10730?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-10730 published?

CVE-2020-10730 was published on 2020-07-07 and last updated on 2026-06-17.

CVE-2020-10730

CVE-2020-10730 is a medium-severity vulnerability in Redhat Storage with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-416.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 2% (82nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-416
Affected product: Redhat Storage
Published: 2020-07-07
Last modified: 2026-06-17

Description

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Frequently asked questions

What is CVE-2020-10730?: A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.
How severe is CVE-2020-10730?: CVE-2020-10730 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2020-10730 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-10730?: CVE-2020-10730 primarily affects Redhat Storage. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-10730?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-10730 published?: CVE-2020-10730 was published on 2020-07-07 and last updated on 2026-06-17.

References

Affected products (7)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

More vulnerabilities in Redhat Storage

CVE-2022-26148 — Critical (CVSS 9.8): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the…
CVE-2012-4406 — Critical (CVSS 9.8): OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing…
CVE-2012-1823 — Critical (CVSS 9.8): sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does…
CVE-2012-1938 — Critical (CVSS 9.3): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and…
CVE-2023-3961 — Critical (CVSS 9.1): A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain…
CVE-2012-0247 — High (CVSS 8.8): ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly…

All CVEs affecting Redhat Storage →

Other CWE-416 (Use After Free) vulnerabilities

CVE-2026-13782 — Critical (CVSS 10.0): Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the…
CVE-2026-4725 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149…
CVE-2026-4688 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox…
CVE-2025-24085 — Critical (CVSS 10.0): A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3,…
CVE-2024-43102 — Critical (CVSS 10.0): Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of…
CVE-2021-32495 — Critical (CVSS 10.0): Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory…

Browse all CWE-416 (Use After Free) vulnerabilities →