Skip to content
fr Sign in
5.9 Medium

CVE-2026-40355 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls…

Description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Affected products and versions

Product Affected versions Fixed in
Kerberos 5 1.18 1.18 → < 1.22.3 1.22.3
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.7 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Kerberos 5

The 3 CVEs of Kerberos 5 →
CVE-2026-40356 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an… 5.9 Medium CVE-2025-24528 In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update… 7.1 High
Track this CVE