UBUNTU-CVE-2026-112318: Null Pointer Dereference

Published Nov 10, 2026

Updated

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to authenticate to the Kerberos administration service and send policy-related RPC requests to kadmind. The issue is remotely reachable, but it does not permit unauthenticated exploitation according to the provided vector.

What is the practical impact?

A crafted policy request with an empty policy name can trigger a NULL pointer dereference in kadmind, causing the service to crash. The stated impact is denial of service; no confidentiality or integrity impact is indicated.

What request condition triggers the crash?

The policy name must decode as NULL through xdr_nullstring() and reach authorization checks or logging code. An empty policy name in a policy request is identified as the triggering input.

UBUNTU-CVE-2026-112318: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

What request condition triggers the crash?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

What request condition triggers the crash?