CVE-2026-107778 in Kerberos 5
Summary
by MITRE • 10/09/2026
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in MIT Kerberos 5 versions up to and including 1.22.2 represents a critical stability issue within the core authentication library that handles credential management. Specifically, the flaw resides in the make_cred_list function located in the rd_cred.c source file. This component is responsible for parsing and processing KRB-CRED messages, which are used to transfer credentials between Kerberos clients and servers or to forward existing tickets. The root cause of this vulnerability is a NULL pointer dereference that occurs when the library attempts to process arrays containing mismatched data structures. In normal operation, the number of forwarded tickets in a credential message should correspond with the associated ticket information entries. However, an authenticated attacker can exploit this logic error by constructing and sending KRB-CRED messages where the count of forwardable tickets exceeds the number of available ticket_info entries.
When such malformed input is processed through the GSS-API acceptor context via gss_accept_sec_context(), the application fails to validate the structural integrity of the incoming credential array before attempting to access specific indices within it. Because the code assumes a one-to-one correspondence between tickets and their metadata, accessing an index that does not exist results in the program dereferencing a NULL pointer. This type of memory error is catastrophic for most server-side applications relying on Kerberos authentication, as it typically triggers an immediate segmentation fault or access violation exception. Consequently, this leads to the abrupt termination of the accepting service process. For services such as web servers, database connectors, or enterprise application gateways that depend on continuous availability and rely on MIT Kerberos 5 for user verification, this results in a complete denial of service condition until the affected processes are manually restarted by system administrators.
From a threat modeling perspective, this vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check if a pointer is null before using it. The attack vector leverages authenticated access, meaning an adversary must first possess valid Kerberos credentials or otherwise bypass initial authentication layers to reach the vulnerable code path. This characteristic places the vulnerability within the MITRE ATT&CK framework under techniques related to Resource Hijacking and Denial of Service, specifically involving local exploitation after gaining a foothold in the network environment. The impact is primarily availability-focused rather than confidentiality or integrity focused, as there is no indication that this flaw allows for arbitrary code execution or data exfiltration directly through the crash itself.
Mitigation strategies must focus on both immediate remediation and long-term architectural resilience. The primary defense is to upgrade the MIT Kerberos 5 installation to version 1.23.0 or later, where developers have implemented proper bounds checking within make_cred_list() to ensure that ticket counts match their corresponding metadata arrays before processing. Organizations should also review their deployment configurations to identify any services running older versions of krb5 and prioritize patching those endpoints first. Additionally, implementing network-level monitoring for anomalous Kerberos traffic patterns can help detect attempts to exploit this flaw in real-time. While upgrading is the definitive solution, temporary mitigations might include restricting access to GSS-API accepting contexts to only trusted internal networks or deploying intrusion detection signatures that flag malformed KRB-CRED messages with mismatched array lengths before they reach the application layer.