CVE-2026-107708 MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
A malicious cross-realm KDC can crash the MIT Kerberos KDC by sending a malformed S4U2Proxy request, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107708?
CVE-2026-107708 is a medium-severity vulnerability in MIT krb5, published on 8 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Weakness: CWE-476
Which versions are affected by CVE-2026-107708?
How do I fix CVE-2026-107708?
Apply the vendor's patch.
Is CVE-2026-107708 being exploited?
There is no known exploitation of CVE-2026-107708 in the wild and no public exploit code.
Sources
Also known as AZL-106836, BELL-CVE-2026-107708, DEBIAN-CVE-2026-107708, ECHO-1587-b13a-e744, GHSA-wc3c-9xc9-26g8, UBUNTU-CVE-2026-107708.