Is CVE-2026-107778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107778 being exploited in the wild.

How severe is CVE-2026-107778?

Medium severity, with a CVSS score of 6.5, published 8 October 2026.

Is there a fix for CVE-2026-107778?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107778 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107778?

Check whether you run Mit Kerberos 5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107778: MIT Kerberos 5 NULL pointer dereference in rd_cred

CVE-2026-107778 · Severity: medium · CVSS 6.5 · Published 2026-10-08

MIT Kerberos 5 (krb5) is an authentication system widely used for single sign-on in corporate networks and Unix systems. A flaw in how it processes forwarded credentials allows an authenticated attacker to crash Kerberos-enabled services by sending specially crafted credential arrays, resulting in denial of service. Organizations relying on Kerberos for network authentication could experience service outages.

Technologies: Mit Kerberos 5. Vendors: Mit.

Quick answers

Is CVE-2026-107778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107778 being exploited in the wild.
How severe is CVE-2026-107778?: Medium severity, with a CVSS score of 6.5, published 8 October 2026.
Which products and versions are affected?: Mit Kerberos 5 through 1.22.2.
Is there a fix for CVE-2026-107778?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107778 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107778?: Check whether you run Mit Kerberos 5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in the make_cred_list() function in rd_cred.c when processing KRB-CRED messages with mismatched ticket and ticket_info array counts. An authenticated Kerberos client can trigger this crash by submitting forwarded credentials through gss_accept_sec_context() where the number of tickets exceeds the number of ticket_info entries, causing GSS-API acceptor services to crash. The vulnerability requires prior Kerberos authentication but can lead to complete denial of service for affected services.

Affected products

MIT Kerberos 5 through 1.22.2

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.