MIT Kerberos EUVD-2026-95255

Exploitation requires that the victim realm has a cross-realm trust relationship and that the attacker controls or has compromised a KDC in that trusted foreign realm - a high-privilege position, not anonymous access. The attacker must then send an S4U2Proxy (Kerberos constrained delegation) request carrying a PAC with a malformed client name. Limiting factors: single-realm deployments with no cross-realm trusts are not exposed to this path, and the attacker must already occupy the trusted-KDC role (reflected in PR:H); there is no user interaction or non-default feature toggle required beyond cross-realm/S4U2Proxy usage. Impact is confined to availability (KDC crash / authentication denial).

This is a moderate-severity denial-of-service issue whose real-world risk is heavily constrained by its privilege prerequisite, not its network attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 6.9, but the PR:H metric is the decisive signal: exploitation requires the attacker to already control a cross-realm KDC that the victim realm explicitly trusts, so this is not an anonymous internet-facing flaw. Impact is availability-only (VA:H, VC:N/VI:N) - a crash of krb5kdc denying authentication - with no confidentiality or integrity consequence. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is identified; the only exploitation-adjacent artifact is the upstream patch diff itself, which is remediation evidence, not a POC. Signals are consistent rather than conflicting (CWE-476 NULL-pointer-deref matches the DoS-only impact and the AV:N/PR:H framing matches a cross-realm-KDC threat model), so this is a genuine but situational priority: urgent for organizations running multi-realm/cross-realm Kerberos trusts, low urgency for single-realm deployments. No independent EPSS/KEV data was supplied to confirm or rule out exploitation at scale.

An attacker who has compromised (or operates) a KDC in a realm that the target realm trusts for cross-realm authentication crafts an S4U2Proxy (constrained delegation) request containing a PAC with a malformed client name. When the victim's krb5kdc processes it, get_pac_princ_with_realm() returns success but leaves the client principal NULL, and the subsequent dereference crashes the KDC, denying authentication service-wide. No public exploit code was identified at the time of analysis.