5.9
Moyenne
CVE-2026-40356 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an…
Description
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kerberos 5 1.18 | 1.18 → < 1.22.3 | 1.22.3 |
Références
- web.mit.edu web.mit.edu
- cems.fun cems.fun
- github.com github.com
Chronologie
- Publiée
- Dernière modification