Read the docs
TI-2026-69754 Aliases CVE-2026-107708

NULL pointer dereference in MIT krb5 KDC lets trusted KDCs crash it

Priority LOW 31CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

MIT krb5 through 1.22.2 contains a NULL pointer dereference (CWE-476) in the KDC's PAC principal handling, which returns success while leaving the client principal NULL on malformed names. A malicious or compromised KDC that is trusted across domains can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moos-ivpkrb5up to 1.22.2—No fix listedCNA
  • krb5 Vendormoos-ivp Affected up to 1.22.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for MIT krb5. Red Hat fixes Red Hat Hardened Images in RHSA-2026:80481. Red Hat Enterprise Linux 6 has no fix planned, Red Hat Enterprise Linux 8, 9 and 10 have no fix available, and Red Hat OpenShift AI (RHOAI) is listed as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:80481 Released 2026-10-11 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images krb5-1.22.2-10.3.hum1@src, krb5-devel-1.22.2-10.3.hum1@aarch64, krb5-devel-1.22.2-10.3.hum1@s390x +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat Hardened ImagesFixed RHSA-2026:80481
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107708
  2. 2026-10-10 Priority changed: MEDIUM → LOW
  3. 2026-10-13 Fix available: RHSA-2026:80481 · Red Hat
  4. 2026-10-13 Fix available: Red Hat Hardened Images · Red Hat
  5. 2026-10-14 CISA SSVC decision points changed
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-11-06 Affected versions changed · Red Hat

References

Patch 3

Other 2

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2024-17421 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVSS 3.1HIGH 7.5
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-29130 NULL pointer dereference in moos-ivp Kerberos 5 CVSS 3.1HIGH 7.5
  • TI-2007-00929 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass… CVSS 2.0HIGH 10.0
  • TI-2011-00268 The process_chpw_request function in schpw.c in the password-changing functionality in… CVSS 2.0HIGH 10.0
See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences