Windows Kerberos CVE-2026-42903

Exploitation requires an attacker to hold at minimum a low-privilege authenticated credential within the target domain or network environment (PR:L per CVSS vector). The attacker must have network access to reach the target system on Kerberos service ports (typically TCP/UDP 88). No user interaction is required (UI:N). Exploitation is fundamentally limited by the authentication prerequisite: unauthenticated external attackers cannot directly exploit this vulnerability without first obtaining valid credentials. No specific non-default configuration or feature enablement is indicated as required by the available description - the vulnerability appears present in the standard Kerberos authentication path. The scope is unchanged (S:U), meaning a successful exploit does not allow the attacker to pivot beyond the availability impact on the targeted component.

The CVSS 6.5 Medium score reflects genuine but bounded risk. The network attack vector (AV:N) with low complexity (AC:L) and no user interaction (UI:N) makes the vulnerability easy to trigger remotely, but the low-privileges requirement (PR:L) is a meaningful limiting factor - the attacker must hold a valid domain credential. The impact is exclusively availability (A:H, C:N, I:N), meaning no data is exposed and no integrity violations occur; the worst outcome is a service or system crash. No EPSS score was provided, so exploitation probability cannot be quantified probabilistically. The absence of a CISA KEV listing and lack of identified POC code indicate this is not currently under active widespread exploitation. Real-world priority is moderate: relevant primarily to environments where authenticated internal users or compromised accounts present a threat model, particularly against Domain Controllers where Kerberos service disruption would cascade into authentication outages across the domain. It is not a critical internet-facing risk due to the authentication prerequisite.

An authenticated domain user - or an attacker who has compromised any low-privilege domain account - sends a specially crafted Kerberos authentication request over the network to a target Windows server or Domain Controller. The malformed request triggers a null pointer dereference in the Windows Kerberos implementation, causing the Kerberos service to crash and rendering authentication services unavailable. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation would be straightforward once a triggering request structure is identified.