Is CVE-2026-11850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11850 being exploited in the wild.

How severe is CVE-2026-11850?

Medium severity, with a CVSS score of 5, published 11 June 2026.

Is there a fix for CVE-2026-11850?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11850 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11850?

Check whether you run Mit Krb5. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11850: MIT krb5 integer underflow in berval2tl_data function

CVE-2026-11850 · Severity: medium · CVSS 5 · Published 2026-06-11

A security vulnerability has been identified in MIT krb5, a widely used implementation of the Kerberos authentication protocol. The issue occurs when the Kerberos service interacts with a compromised or malicious LDAP database backend. An attacker who controls the database could cause the authentication service to crash or potentially leak sensitive memory information, impacting the reliability and security of the network's authentication infrastructure.

Technologies: Mit Krb5. Vendors: Mit.

Quick answers

Is CVE-2026-11850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11850 being exploited in the wild.
How severe is CVE-2026-11850?: Medium severity, with a CVSS score of 5, published 11 June 2026.
Which products and versions are affected?: MIT krb5.
Is there a fix for CVE-2026-11850?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11850 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11850?: Check whether you run Mit Krb5. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in MIT krb5 within the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The vulnerability is caused by an unsigned subtraction (bv_len - 2) performed without a prior bounds check. If a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with a length of 0 or 1, the subtraction wraps to a large value and is truncated to a uint16_t (0xFFFE or 0xFFFF). This leads to a large malloc and a subsequent memcpy that reads beyond the bounds of the small input buffer. This heap out-of-bounds read can be triggered when the KDC or kadmind processes principal data from the LDAP backend. A fix is available in the upstream krb5 repository.

Affected products

MIT krb5

Timeline

2026-04-21: disclosed: Initial report in Red Hat Bugzilla
2026-06-11: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.