Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107778MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

Medium 6.5

In plain English

A medium-severity null pointer dereference in krb5 from MIT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	krb5	no fix listed	DEBIAN-CVE-2026-107778
Debian:13	krb5	no fix listed	DEBIAN-CVE-2026-107778
Debian:14	krb5	no fix listed	DEBIAN-CVE-2026-107778
Ubuntu:22.04:LTS	krb5	no fix listed	UBUNTU-CVE-2026-107778
Ubuntu:24.04:LTS	krb5	no fix listed	UBUNTU-CVE-2026-107778
Ubuntu:26.04:LTS	krb5	no fix listed	UBUNTU-CVE-2026-107778
Ubuntu:26.10	krb5	no fix listed	UBUNTU-CVE-2026-107778

Affected products (as reported)

Vendor	Product	Versions
MIT	krb5	0 – through 1.22.2

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Pull Request #1511 issue-tracking, patch
Patch Commit patch
https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a patch
https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112 technical-description
https://github.com/krb5/krb5 product
VulnCheck Advisory: MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred() third-party-advisory