DEBIAN-CVE-2026-112318: Null Pointer Dereference
The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication?
Yes. The issue is exploitable by a remote authenticated user; it is not described as unauthenticated.
What must an attacker send to trigger the crash?
The attacker must send a policy request with an empty policy name. The request must reach authorization checks or logging code, where a NULL pointer can be dereferenced.
What is the practical impact of successful exploitation?
Successful exploitation can crash kadmind, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
Which upstream versions are described as affected?
MIT Kerberos 5 versions 1.5.3 and later are described as affected. The data does not provide a Debian package version containing a fix.