CVE-2026-107778: MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in makecredlist() in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through gssacceptseccontext() to crash GSS-API acceptor services, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which services are exposed to this issue?
GSS-API acceptor services that process forwarded Kerberos credentials through gss_accept_sec_context() are exposed. The affected path is triggered when the forwarded KRB-CRED data has more tickets than ticket_info entries.
What does an attacker need to exploit the vulnerability?
The attacker must be an authenticated Kerberos client and be able to send crafted forwarded credentials to the target service. No user interaction is required.
What is the practical impact of successful exploitation?
Successful exploitation crashes the affected service through a NULL pointer dereference, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.