Integer Underflow Vulnerability in MIT Kerberos 5 by MIT

CVE-2026-40356

What is CVE-2026-40356?

In versions prior to 1.22.3 of MIT Kerberos 5, an integer underflow vulnerability exists that may lead to an out-of-bounds read when gss_accept_sec_context() is invoked on a system with a registered NegoEx mechanism in /etc/gss/mech. This could allow an unauthenticated remote attacker to exploit the flaw, potentially causing the affected application process to crash during message parsing.

References