CVE-2026-40356
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MIT | Kerberos 5 | 1.18 < 1.22.3 | affected |
Weaknesses
- CWE-191: CWE-191 Integer Underflow (Wrap or Wraparound)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://web.mit.edu/kerberos/advisories/
- https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html
- https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.