Executive brief
A security vulnerability has been identified in MIT krb5, a widely used implementation of the Kerberos authentication protocol. The issue occurs when the Kerberos service interacts with a compromised or malicious LDAP database backend. An attacker who controls the database could cause the authentication service to crash or potentially leak sensitive memory information, impacting the reliability and security of the network's authentication infrastructure.
Technical details
An integer underflow vulnerability exists in MIT krb5 within the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The vulnerability is caused by an unsigned subtraction (bv_len - 2) performed without a prior bounds check. If a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with a length of 0 or 1, the subtraction wraps to a large value and is truncated to a uint16_t (0xFFFE or 0xFFFF). This leads to a large malloc and a subsequent memcpy that reads beyond the bounds of the small input buffer. This heap out-of-bounds read can be triggered when the KDC or kadmind processes principal data from the LDAP backend. A fix is available in the upstream krb5 repository.
Affected products
- MIT krb5
Timeline
- 2026-04-21: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-11: advisory: NVD publication date