CVE-2026-107708

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107708
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107708.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107708
Downstream
AZL (1)
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
OESA (3)
RHSA (1)
SUSE (1)
UBUNTU (1)
Related
Published
2026-10-08T20:15:53Z
Modified
2026-10-28T10:46:01Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
Details

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107708.json"
}
References

Affected packages

Git / github.com/krb5/krb5

Affected ranges

Type
GIT
Repo
https://github.com/krb5/krb5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7
Fixed
a88a18cafa1040a0c4f9c8d08288fc98831ec86d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.22.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "a88a18cafa1040a0c4f9c8d08288fc98831ec86d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

kfw-4.*
kfw-4.4-beta1
krb5-1.*
krb5-1.22-beta1
krb5-1.22-final
krb5-1.22.1-final
krb5-1.22.2-final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107708.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "254234380912824549746955713731411545485",
            "length":  652
        },
        "id":  "CVE-2026-107708-5e313562",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7",
        "target":  {
            "file":  "src/kdc/kdc_util.c",
            "function":  "get_pac_princ_with_realm"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "254234380912824549746955713731411545485",
            "length":  652
        },
        "id":  "CVE-2026-107708-c1f5f9b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d",
        "target":  {
            "file":  "src/kdc/kdc_util.c",
            "function":  "get_pac_princ_with_realm"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "33215838841685194600862534667628514586",
                "261627834316101627520821143497535324706",
                "42979148895888816558981422062954181780",
                "37425219445733615591410694694090391650",
                "12265464477381806599372964269657630858",
                "208333242379978458045750881566043022779",
                "204040193017496922248385600184843438060",
                "118957430610803124967364131146307340615"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107708-cc1eceac",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7",
        "target":  {
            "file":  "src/kdc/kdc_util.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "33215838841685194600862534667628514586",
                "261627834316101627520821143497535324706",
                "42979148895888816558981422062954181780",
                "37425219445733615591410694694090391650",
                "12265464477381806599372964269657630858",
                "208333242379978458045750881566043022779",
                "204040193017496922248385600184843438060",
                "118957430610803124967364131146307340615"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107708-dae6f533",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d",
        "target":  {
            "file":  "src/kdc/kdc_util.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:46:01Z"