CVE-2026-107708
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Text from CVE List
Affected versions 1
- krb5affected: all versions through 1.22.2CVE List
References 6
- github.com/krb5/krb5/pull/1510Fixvia CVE List
- github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7Fixvia CVE List
- github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86dFixvia CVE List
- vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pacAdvisoryvia CVE List
- github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676Referencevia CVE List
- github.com/krb5/krb5Referencevia CVE List