CVE-2026-11850: 
Kerberos vulnerability analysis and mitigation

CVE-2026-11850 is an integer underflow vulnerability in MIT Kerberos 5 (krb5) within the berval2tl_data() function located in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The flaw causes a heap out-of-bounds read when a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with a length (bv_len) of 0 or 1. The vulnerability was reported to Red Hat Bugzilla on 2026-04-21 and publicly disclosed on 2026-06-11. It carries a CVSS v3.1 base score of 5.0 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer underflow (CWE-191) combined with a subsequent out-of-bounds read (CWE-125) in berval2tl_data(). The function performs the unsigned subtraction bv_len - 2 without first verifying that bv_len >= 2; when bv_len is 0 or 1, the result wraps around to a large unsigned value that is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). A malloc() call using this wrapped value succeeds, and a subsequent memcpy() reads up to 65534 bytes from a buffer that contains only 0–1 valid bytes, resulting in a heap out-of-bounds read. The attack requires a malicious or compromised LDAP KDB backend to return a crafted krbExtraData attribute with bv_len < 2, which is then processed by the KDC or kadmind when reading principal data. An upstream fix is referenced at commit 2a5fd83 in the krb5 repository and tracked as MIT ticket #9206 (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows an attacker controlling or compromising the LDAP KDB backend to cause the KDC or kadmind process to read up to 65534 bytes of heap memory beyond the intended buffer boundary. This can result in disclosure of sensitive in-memory data (low confidentiality impact) and a potential crash of the KDC or kadmind service (high availability impact). Integrity is not directly affected. Because the KDC is central to Kerberos authentication infrastructure, a service crash could disrupt authentication for all dependent systems in the realm (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). Exploitation requires high privileges — specifically, the ability to control or compromise the LDAP KDB backend — and high attack complexity, significantly limiting the attacker pool. The EPSS score is approximately 0.035% (0.261% per GitHub Advisory), placing it in a low exploitation-probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain control of the LDAP KDB backend: The attacker must either compromise an existing LDAP server used as the Kerberos KDB backend or operate a rogue LDAP server that the KDC is configured to trust.
2. Craft a malicious krbExtraData attribute: Modify or inject a principal entry in the LDAP directory such that the krbExtraData attribute has a bv_len value of 0 or 1 (i.e., fewer than 2 bytes).
3. Trigger principal data retrieval: Cause the KDC or kadmind to read the manipulated principal entry — for example, by initiating an authentication request for the affected principal or by querying it via kadmin.
4. Trigger the underflow: The berval2tl_data() function computes bv_len - 2 without bounds checking, wrapping to 0xFFFE or 0xFFFF, which is used as the allocation and copy size.
5. Achieve heap out-of-bounds read: memcpy reads up to 65534 bytes from the 0–1 byte buffer into the allocated heap region, potentially exposing sensitive heap contents (e.g., keying material, tickets) or crashing the KDC/kadmind process (Red Hat Bugzilla, Github Advisory).

• Logs: Unexpected crashes or segmentation faults in KDC (krb5kdc) or kadmind logs, particularly when processing specific principal entries; LDAP access logs showing unusual modifications to krbExtraData attributes with very short values.
• File System: Unauthorized modifications to LDAP directory entries for Kerberos principals, especially changes to krbExtraData attribute values to 0 or 1 byte in length.
• Process: Abnormal termination (core dumps) of krb5kdc or kadmind processes; unexpected restarts of these services by init/systemd.
• Network: Unusual LDAP write operations originating from unexpected source IPs targeting the Kerberos LDAP backend; LDAP bind operations from unauthorized accounts with write access to krbExtraData.

Red Hat has released a patched package for Red Hat Hardened Images: krb5-1.22.2-8.hum1 (covering krb5-libs, krb5-server, krb5-server-ldap, and related packages for aarch64 and x86_64), addressed in security advisory RHSA-2026:25520 issued 2026-06-12 (Red Hat Advisory). The upstream fix is available at commit 2a5fd83 in the krb5 GitHub repository (Red Hat Bugzilla). As a workaround, restrict access to the LDAP KDB backend to trusted administrators only, implement network segmentation to limit KDC-to-LDAP communication to authorized systems, and monitor LDAP connections and principal data modifications for suspicious activity.