Integer Underflow Vulnerability in MIT Kerberos 5 by MIT

CVE-2026-11850

What is CVE-2026-11850?

An integer underflow vulnerability exists in the MIT Kerberos 5 authentication system within the berval2tl_data() function. This issue arises due to an unsigned subtraction operation performed without proper bounds checking. Specifically, when the buffer length (bv_len) is either 0 or 1, subtracting 2 leads to a wrap-around, resulting in excessively large values that, when truncated, can provoke a severe heap out-of-bounds condition. The consequence of this flaw is that it allows the reading of excessive bytes from a buffer that should contain only 0-1 bytes. Exploitation of this vulnerability is possible when a malicious LDAP KDB backend sends a krbExtraData attribute with a buffer length less than 2 during normal operations, thereby compromising the security of the affected system.

References