CVE-2026-107708: MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MIT krb5 KDC deployments through 1.22.2 are affected where they process S4U2Proxy requests involving a cross-realm trusted KDC and PAC data.
What does an attacker need to exploit the vulnerability?
The attacker must control or compromise a cross-realm trusted KDC. That KDC can submit an S4U2Proxy request with a PAC containing a malformed client name.
What is the operational impact of successful exploitation?
Successful exploitation crashes krb5kdc, causing denial of authentication services. The provided impact data indicates availability impact only, with no confidentiality or integrity impact.