Read the docs
TI-2025-18245 Aliases CVE-2025-24528GHSA-wrjh-fhfj-xhfm

Integer overflow in moos-ivp Kerberos 5

Priority LOW 32CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Partial Kerberos 5 (MIT): 1.22Red Hat: 5 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moos-ivpKerberos 51.7 to before 1.221.22Patch availableCNA
  • Kerberos 5 Vendormoos-ivp Affected 1.7 to before 1.22 Fixed in 1.22 Patch available CNA

Remediation

  • Fix · CNA Kerberos 5 (MIT) Fixed in 1.22

Red Hat 5 advisories

  • RHSA-2025:8385 Released 2025-06-02 · Red Hat rating Moderate
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 1.14 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:7067 Released 2025-05-13 · Red Hat rating Moderate
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-6.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-6.el9, krb5-libs-1.21.1-6.el9, krb5-pkinit-1.21.1-6.el9 +4
  • RHSA-2025:2789 Released 2025-03-13 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.0 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
Show 2 more Red Hat advisories
  • RHSA-2025:2722 Released 2025-03-13 · Red Hat rating Moderate
    krb5 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) krb5-1.18.2-31.el8_10, krb5-devel-1.18.2-31.el8_10, krb5-libs-1.18.2-31.el8_10 +5
  • RHSA-2025:1352 Released 2025-02-12 · Red Hat rating Moderate
    krb5 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) krb5-1.15.1-55.el7_9.4, krb5-devel-1.15.1-55.el7_9.4, krb5-devel-1.15.1-55.el7_9.4.ppc +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Discovery 1.14Fixed RHSA-2025:8385
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7067
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:2722
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:7067
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:1352
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:2789
Not affected: 3 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift distributed tracing 3.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24528
  2. 2026-10-03 Alias added: GHSA-wrjh-fhfj-xhfm
  3. 2026-10-21 Affected versions changed · Red Hat
  4. 2026-10-22 Affected versions changed · Red Hat

References

Other 2

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2024-17421 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVSS 3.1HIGH 7.5
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-29130 NULL pointer dereference in moos-ivp Kerberos 5 CVSS 3.1HIGH 7.5
  • TI-2007-00929 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass… CVSS 2.0HIGH 10.0
  • TI-2011-00268 The process_chpw_request function in schpw.c in the password-changing functionality in… CVSS 2.0HIGH 10.0
See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences