MIT Kerberos 5 CVE-2026-107778

Exploitation requires (1) a valid Kerberos client credential (PR:L - the attacker must authenticate), and (2) a target running an MIT krb5 (through 1.22.2) GSS-API acceptor service that processes forwarded/delegated credentials via gss_accept_sec_context(). The specific trigger is a KRB-CRED message whose ticket array contains more tickets than its corresponding encrypted ticket_info entries, causing make_cred_list() in rd_cred.c to dereference a NULL info pointer. Limiting factors: the attacker must already be an authenticated Kerberos principal; only services that accept forwarded credentials are reachable; and impact is limited to denial of service (service crash) with no confidentiality or integrity effect.

This is a moderate-priority availability issue rather than a critical emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 and confirms a network-reachable, low-complexity attack, but PR:L means the attacker must hold valid Kerberos credentials, and the impact is confined to availability (VC:N/VI:N/VA:H) - there is no data disclosure or code execution. The source-code evidence (the PR #1511 diff adding a NULL check for an unexpectedly-exhausted ticket_info list) strongly corroborates the CWE-476 NULL pointer dereference described, so the vulnerability itself is well-substantiated. No EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public exploit was supplied, so exploitation probability cannot be quantified from these signals; absence of EPSS/KEV/POC here reflects missing data, not confirmed safety. No SSVC decision data was provided. Net: a credible authenticated denial-of-service against Kerberos GSS-API acceptor services - worth patching promptly on exposed krb5 acceptors, but it does not carry the urgency of an unauthenticated RCE or an actively-exploited flaw.

An attacker who already possesses valid Kerberos credentials initiates a GSS-API context with a target acceptor service that accepts forwarded (delegated) credentials, sending a crafted KRB-CRED structure containing more tickets than ticket_info entries. When the acceptor calls gss_accept_sec_context() and krb5 processes the credentials in make_cred_list(), the mismatch triggers a NULL pointer dereference that crashes the service, causing denial of service. No public exploit code was provided in the input, though the upstream patch diff reveals the exact trigger condition.