Zeek EUVD-2026-42598

Exploitation requires only that Zeek (before 8.0.9) be observing traffic on the target segment with its Kerberos analyzer active (the default) and that the attacker can inject a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) carrying a PA-DATA element of padata-type 2, 3, 11, or 19 to port 88 (UDP or TCP). No credentials, authentication, or prior session are needed (PR:N/UI:N), and a single packet suffices. The practical limiting factor is traffic placement: because Zeek analyzes traffic it passively observes, the attacker must get the malicious Kerberos packet onto a link that the sensor monitors (e.g., within the monitored broadcast/routed path), and the analyzer must not have been disabled or filtered as a mitigation.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and a pure availability impact (VA:H) with no confidentiality or integrity loss - i.e., a crash-only DoS, not code execution. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; POC availability is not indicated in the source data. The realistic priority is elevated by the fact that Zeek is a security-monitoring sensor - crashing it creates a visibility gap (defenders go blind) that an attacker could pair with a follow-on intrusion - and by the trivial single-packet trigger against default Kerberos parsing. However, impact is bounded to availability of the sensor itself, so this is a meaningful reliability/blind-spot risk rather than a system-compromise event. Note the availability caveat: VA:H reflects sensor crash, not a scope change to other systems.

An attacker with the ability to place traffic on a network segment monitored by Zeek sends a single crafted Kerberos KRB_ERROR packet (error-code 25 with a PA-DATA element of padata-type 2, 3, 11, or 19) to port 88 over UDP or TCP. Zeek's Kerberos analyzer dereferences the uninitialized pa_data_element field and the sensor crashes, dropping monitoring coverage; the packet needs no credentials, no user interaction, and low complexity. No public exploit is identified at time of analysis, but the trigger is simple enough to reproduce from the description.