CVE-2026-107708
MEDIUM
NVD
CVSS Score
4.9
Severity
MEDIUM
Published
Oct 08, 2026
Vendor
unknown
Description
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.