CVE-2026-91926 in gss-ntlmssp
Summary
by MITRE • 09/15/2026
A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in gss-ntlmssp represents a critical resource management flaw within the implementation of the Generic Security Services Application Program Interface (GSSAPI) for NT LAN Manager Secure Service Provider Principal Name (NTLM SSP). This specific defect resides in the parser responsible for processing target-info structures embedded within NTLM CHALLENGE messages. The core technical issue is a failure to properly manage memory allocation when handling duplicate Attribute-Value Pair entries. In standard protocol operations, an AV_PAIR entry consists of a type identifier and associated data. When the parser encounters such an entry, it allocates heap memory to store the string value. However, if the crafted NTLM CHALLENGE message contains multiple AV_PAIRs with identical types, the software fails to release or overwrite the previously allocated memory block before assigning new storage for the subsequent duplicate entry. This oversight results in a classic use-after-free scenario where the pointer to the original allocation is lost without being deallocated, leading directly to a memory leak.
From an operational perspective, this flaw allows any entity capable of intercepting and modifying network traffic during the authentication handshake to exploit the condition. A malicious actor or a man-in-the-middle attacker can construct NTLM CHALLENGE messages that repeatedly include duplicated AV_PAIR entries with varying string values. Each time such a message is processed by the vulnerable client application, additional memory remains allocated but inaccessible for garbage collection. Over time, as these crafted challenges are sent during authentication attempts, the client process experiences gradual and continuous memory exhaustion. This resource depletion does not typically result in immediate code execution or privilege escalation but rather degrades system stability until the operating system's out-of-memory killer terminates the affected application or service.
The impact of this vulnerability is primarily categorized as a denial of service against the authenticating client. By forcing the target process to consume increasing amounts of RAM, an attacker can effectively crash authentication services such as Samba clients, web browsers utilizing NTLM single sign-on, or enterprise applications relying on GSSAPI for network security. This disruption affects availability and integrity of user sessions without requiring high privileges on the victim machine. The attack vector is remote if the client connects to a compromised server or passes through an untrusted network segment where traffic can be manipulated. Consequently, this flaw undermines the reliability of NTLM-based authentication flows in environments that do not enforce strict validation of incoming protocol structures.
Mitigation strategies should focus on both immediate patching and long-term architectural improvements. The primary remediation is to apply vendor-provided updates for gss-ntlmssp as soon as they become available, ensuring the parser logic correctly frees previous allocations when duplicate AV_PAIR types are detected. In addition to software patches, network security controls can be employed to detect anomalous NTLM traffic patterns indicative of this exploitation attempt. Security teams should monitor for high-frequency authentication failures or unusual memory consumption spikes in services handling NTLM challenges. Furthermore, organizations should consider migrating away from NTLM where possible toward more secure protocols like Kerberos, which do not suffer from these specific parsing ambiguities and offer stronger cryptographic guarantees against man-in-the-middle attacks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-401, which describes a missing release of memory after successful allocation. The exploitation technique corresponds to ATT&CK tactic T1499, Endpoint Denial of Service, specifically under the subtechnique for resource exhaustion via application vulnerabilities. Understanding these mappings helps security operations centers prioritize response efforts based on established industry frameworks and threat intelligence models.