CVE-2026-107778

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in MIT Kerberos 5

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107778

Affected Vendors & Products

Vendor	Product	Version / Range
MIT	krb5	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in MIT Kerberos 5 (krb5) versions up to 1.22.2. It occurs in the make_cred_list() function in rd_cred.c when authenticated Kerberos clients send mismatched KRB-CRED arrays. Attackers exploit this by sending forwarded credentials with more tickets than ticket_info entries via gss_accept_sec_context(), crashing GSS-API acceptor services and causing denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in GSS-API acceptor services or analyzing network traffic for forwarded credentials with mismatched KRB-CRED arrays. Check logs for service crashes during Kerberos authentication attempts. Use packet capture tools like tcpdump or Wireshark to inspect KRB-CRED messages for inconsistencies in ticket counts.

Impact Analysis

This vulnerability allows authenticated attackers to crash Kerberos services by sending specially crafted credential arrays. This can lead to service outages, disrupting authentication and authorization processes for legitimate users and applications relying on Kerberos.

Compliance Impact

This vulnerability causes denial of service by crashing GSS-API acceptor services through a NULL pointer dereference. While not directly violating GDPR or HIPAA, such disruptions could impact availability of critical systems handling personal or health data, potentially leading to compliance issues if service continuity is required by these regulations.

Mitigation Strategies

Update MIT Kerberos 5 to version 1.22.2 or later to address the NULL pointer dereference in make_cred_list().

Hi! I’m here to help you understand CVE-2026-107778. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70