DEBIAN-CVE-2026-11850

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-11850
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11850.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-11850
Upstream
  • CVE-2026-11850
Published
2026-06-11T10:16:21Z
Modified
2026-09-14T17:01:41Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
Summary
[none]
Details

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.

References

Affected packages

Debian:12 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.20.1-2
1.20.1-2+deb12u1
1.20.1-2+deb12u2
1.20.1-2+deb12u3
1.20.1-2+deb12u4
1.20.1-2+deb12u5
1.20.1-2+loong64
1.20.1-3
1.20.1-4
1.20.1-5
1.20.1-5.1~exp1
1.20.1-5.1
1.20.1-6
1.21.2-1
1.21.3-1
1.21.3-2
1.21.3-3
1.21.3-4
1.21.3-5
1.22.1-1
1.22.1-2
1.22.1-2.1
1.22.1-3

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11850.json"

Debian:13 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.21.3-5
1.21.3-5+deb13u1
1.22.1-1
1.22.1-2
1.22.1-2.1
1.22.1-3

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11850.json"

Debian:14 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.22.1-3

Affected versions

1.*
1.21.3-5
1.22.1-1
1.22.1-2
1.22.1-2.1

Ecosystem specific 

{
    "urgency":  "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-11850.json"