MIT krb5 CVE-2026-11850

Exploitation is only possible when MIT krb5 is configured to use the LDAP KDB plugin - this is a non-default configuration requiring explicit setup of libkdb_ldap in krb5.conf or kdc.conf. The default file-based (BDB/LMDB) principal database is entirely unaffected. Beyond that configuration prerequisite, the attacker must control or have compromised the specific LDAP server designated as the Kerberos database backend, satisfying the PR:H requirement in the CVSS vector. The malformed attribute (krbExtraData with bv_len < 2) must be served in response to a legitimate principal lookup by the KDC or kadmind. Exploitation is therefore not feasible against a correctly isolated LDAP backend with a clean trust chain. Limiting factors include: non-default LDAP KDB configuration, required high-privilege access to the LDAP backend, and the need to respond to an active KDC query - passive network access alone is insufficient.

The CVSS 3.1 base score of 5.0 with vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H accurately encodes the constrained exploitation path. The network attack vector reflects that the KDC communicates with the LDAP backend over the network, but AC:H and PR:H together indicate that the attacker must already control or have compromised a privileged component of the Kerberos infrastructure - the LDAP KDB backend server itself. This substantially limits opportunistic exploitation. Availability is rated High because crashing the KDC is a Denial-of-Service against authentication infrastructure, which is high-impact in enterprise environments; Confidentiality is only Low since any heap memory leaked goes to an already-privileged attacker. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC are referenced, consistent with this being a researcher-reported flaw without observed in-the-wild exploitation. The realistic threat model is a malicious insider with LDAP admin access, a supply-chain compromise of the LDAP server, or a MITM on an unprotected LDAP channel - not an opportunistic internet attacker. Organizations using the default non-LDAP krb5 KDB backend face zero exposure.

An attacker who has compromised an LDAP server serving as the Kerberos KDB backend constructs a malformed LDAP response to a principal lookup, returning a krbExtraData attribute with bv_len set to 0 or 1. When the KDC or kadmind calls berval2tl_data() to parse the attribute, the unsigned subtraction wraps to 0xFFFE or 0xFFFF, causing a memcpy to read up to 65,534 bytes beyond the 0-1 byte source buffer on the heap, either crashing the KDC process (availability impact) or surfacing heap memory contents to the attacker (confidentiality impact). No public proof-of-concept code has been identified at time of analysis.