CVE-2026-107708: 
Kerberos vulnerability analysis and mitigation

CVE-2026-107708 is a NULL pointer dereference vulnerability in MIT Kerberos 5 (krb5) affecting all versions through 1.22.2. The flaw resides in the KDC's get_pac_princ_with_realm() function in src/kdc/kdc_util.c, which incorrectly returns success (0) while leaving the client principal pointer NULL when processing malformed PAC client names. A malicious or compromised cross-realm trusted KDC can exploit this by sending an S4U2Proxy (constrained delegation) request with a PAC carrying a malformed client name, causing the krb5kdc process to crash and deny authentication services. The vulnerability was disclosed on October 8, 2026, and carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is improper error propagation (CWE-476: NULL Pointer Dereference) in get_pac_princ_with_realm() within src/kdc/kdc_util.c. The function's cleanup label unconditionally executed return 0 instead of return ret, meaning that when the PAC client name string contained an unexpected number of @ characters (zero or three or more), the function set ret = KRB5_PARSE_MALFORMED but still returned success. The caller in do_tgs_req.c then proceeded with a NULL stkt_pac_client pointer (initialized to NULL at line 647), triggering a NULL pointer dereference crash in the KDC. The fix, introduced in commits f6e2c39 (master) and a88a18c (1.22-next branch), changes return 0 to return ret in the cleanup label and also corrects a memory leak of client_str on parse failure (GitHub PR #1510, Commit f6e2c39).

Successful exploitation results in a crash of the krb5kdc process, causing a complete denial of authentication services for all users and services relying on the affected KDC. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Because Kerberos is central to authentication in many enterprise environments (including Active Directory-integrated deployments), a sustained crash can prevent logins, service access, and lateral movement across the realm. The attack is limited to cross-realm scenarios where a malicious or compromised peer KDC has established trust with the victim KDC (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or compromise a cross-realm trusted KDC, which significantly limits the practical attack surface — the MIT krb5 maintainer noted this makes the bug "impractical to exploit" in most environments (GitHub PR #1510). The EPSS score is approximately 0.52%, reflecting low probability of near-term exploitation.

1. Establish cross-realm trust position: The attacker must control or compromise a KDC that has an established cross-realm trust relationship with the target krb5 KDC running a vulnerable version (≤ 1.22.2).
2. Craft a malformed PAC: Construct a Privilege Attribute Certificate (PAC) containing a client name string with an unexpected number of @ characters — either zero or three or more — which will trigger KRB5_PARSE_MALFORMED in get_pac_princ_with_realm().
3. Send an S4U2Proxy request: From the attacker-controlled KDC, send a cross-realm S4U2Proxy (constrained delegation) TGS request to the target KDC, embedding the malformed PAC in the ticket.
4. Trigger NULL pointer dereference: The target KDC's get_pac_princ_with_realm() returns success with a NULL client principal; the caller in do_tgs_req.c dereferences the NULL pointer, crashing the krb5kdc process.
5. Sustain denial of service: Repeat the request to prevent the KDC from recovering, denying authentication to all users and services in the realm (GitHub PR #1510, Commit f6e2c39).

• Logs: Unexpected krb5kdc process termination entries in syslog or the KDC log (e.g., /var/log/krb5kdc.log); repeated KDC crash/restart cycles; error messages referencing PAC processing or KRB5_PARSE_MALFORMED around S4U2Proxy requests.
• Process: Sudden absence of the krb5kdc process; automated restart loops by init/systemd for the krb5kdc service.
• Network: Unusual S4U2Proxy (TGS-REQ with cname in additional tickets) requests originating from cross-realm KDC IP addresses, particularly with malformed principal name fields; repeated TGS requests from the same cross-realm source immediately preceding KDC crashes.

Upgrade MIT krb5 to version 1.22.3 or later, which includes the fix cherry-picked as commit a88a18c (Commit a88a18c). As a workaround where upgrading is not immediately possible, restrict or disable cross-realm trust relationships with untrusted or potentially compromised KDCs, and implement network-level controls to limit S4U2Proxy requests to known-good cross-realm KDC IP addresses. Monitor KDC logs for unexpected crashes or abnormal terminations related to PAC processing. Red Hat has tracked this issue in their bug tracker for affected distributions (Red Hat Bugzilla).

The MIT krb5 maintainer (Greg Hudson) publicly commented in the pull request that he considers the CVE system "too heavyweight for availability-only bugs" and that the limited attack surface (data within a previously verified PAC from a cross-realm peer KDC) makes the bug "impractical to exploit" in most environments. The vulnerability was discovered and reported by researcher TristanInSec, who independently requested CVE assignment after the fix was merged, noting that security bugs in security-critical libraries warrant disclosure even with limited exploitability. Microsoft included this CVE in their October 2026 Patch Tuesday advisory cycle, and it was covered in BleepingComputer's summary of that patch release (GitHub PR #1510, BleepingComputer).