CVE-2026-40356
Received Received - Intake
Integer Underflow in MIT Kerberos 5 gss_accept_sec_context Causes Crash

Publication date: 2026-04-28

Last updated on: 2026-04-28

Assigner: MITRE

Description
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-28
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-04-28
EPSS Evaluated
2026-06-15
NVD
CVE-2026-40356
EUVD
EUVD-2026-25993
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mit kerberos to 1.22.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in MIT Kerberos 5 versions before 1.22.3. It involves an integer underflow and an out-of-bounds read that occurs when an application calls the function gss_accept_sec_context() on a system where a NegoEx mechanism is registered in /etc/gss/mech. An unauthenticated remote attacker can exploit this flaw, potentially causing the affected process to terminate unexpectedly during the parse_message operation.

Impact Analysis

The primary impact of this vulnerability is that an unauthenticated remote attacker can cause the affected process to terminate unexpectedly, leading to a denial of service (DoS) condition. This could disrupt services relying on MIT Kerberos 5 authentication mechanisms.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart