CVE-2026-107708 in krb5
Summary
by MITRE • 10/08/2026
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in MIT Kerberos through version 1.22.2 represents a critical security flaw within the Key Distribution Center, specifically located in the get_pac_princ_with_realm function. This component is responsible for processing Proxy Authentication Certificates during cross-realm authentication scenarios. The core technical issue stems from an improper handling of malformed client principal names embedded within these certificates. When the KDC receives a Service-for-User-to-Proxy request containing such a malformed name, the internal logic fails to validate the input correctly before attempting to dereference pointers associated with the client principal object. Consequently, instead of returning an appropriate error code indicating invalid input or authentication failure, the function erroneously returns success while leaving the client principal pointer as NULL. This logical inconsistency creates a state where subsequent operations within the KDC assume the presence of a valid principal structure and attempt to access memory addresses associated with it.
This null pointer dereference leads directly to an application crash in the krb5kdc process, resulting in a denial of service condition for all users relying on that specific Key Distribution Center instance. The operational impact is significant because Kerberos serves as the primary authentication mechanism for many enterprise environments, particularly those utilizing Active Directory or similar centralized identity management systems. A successful exploitation allows an attacker to disrupt critical infrastructure services by causing repeated crashes of the KDC, thereby preventing legitimate users from obtaining tickets and accessing network resources. This disruption can halt business operations, delay incident response capabilities, and create confusion within security monitoring teams who may initially mistake the crash for a system failure rather than a targeted attack vector.
The exploitability of this vulnerability is heightened by its reliance on cross-realm trust relationships. A malicious or compromised KDC in a trusted external realm can craft specific S4U2Proxy requests that trigger the flaw when processed by the target realm's KDC. This requirement means that while an unauthenticated remote attacker cannot directly exploit it, any entity with access to a trusted Kerberos domain and the ability to send forged authentication requests poses a viable threat vector. The attack aligns with common patterns of abuse in distributed identity systems where trust boundaries are exploited to cause instability or bypass security controls. It is categorized under CWE-476, which denotes NULL Pointer Dereference, highlighting the fundamental programming error that allows memory access violations when expected data structures are absent or invalid.
From a tactical perspective, this vulnerability can be mapped to techniques observed in advanced persistent threat campaigns where availability is targeted alongside confidentiality and integrity. The ATT&CK framework identifies denial of service as a potential impact category, although specific technique mapping for Kerberos-specific DoS may vary based on the exact mechanism used. In this case, the abuse involves crafting malformed authentication payloads that exploit parsing logic flaws within identity providers. This falls under broader categories of input validation failures and potentially resource exhaustion if the crash requires manual restarts or causes cascading failures in clustered KDC deployments.
Mitigation strategies must focus primarily on updating the MIT Kerberos software to version 1.22.3 or later, where this specific null pointer dereference has been addressed through improved input validation and error handling routines within the get_pac_princ_with_realm function. Organizations should prioritize patching their Key Distribution Centers as these components are high-value targets for attackers seeking to disrupt authentication services. In environments where immediate patching is not feasible due to operational constraints, network segmentation can help limit exposure by restricting cross-realm trust relationships to only those absolutely necessary and monitoring for unusual patterns of S4U2Proxy requests originating from external realms. Additionally, implementing robust logging and alerting mechanisms around KDC crashes can aid in rapid detection and response, allowing security teams to identify potential exploitation attempts even if the underlying vulnerability remains unpatched temporarily. Regular audits of cross-realm trust configurations should also be conducted to ensure that only trusted entities are permitted to initiate proxy authentication flows against critical infrastructure components.