CVE-2026-40356

Published: Apr 28, 2026Modified: Jul 8, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

Affected (1)

Products: Mit: Kerberos 5

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	From 1.18.0 to 1.22.2

Related CWEs

Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References (3)

https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html

Source: cve@mitre.org

ExploitThird Party AdvisoryPatch

https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f

Source: cve@mitre.org

Patch

https://web.mit.edu/kerberos/advisories/

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.