CVE-2026-11850 Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read
An integer underflow in MIT Kerberos allows heap out-of-bounds reads via malicious LDAP data, potentially causing information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11850?
CVE-2026-11850 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 11 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.
Weakness: CWE-191
Which versions are affected by CVE-2026-11850?
Linux distribution packages (27)
krb5 Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-devel Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-libs Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-pkinit Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-server Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-server-ldap Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-tests Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-workstation Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5-xrealmauthz Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
libkadm5 Red Hat:hummingbird:1 | All versions | 0:1.22.2-8.hum1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.20.1-150500.3.23.1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.20.1-150500.3.23.1 |
krb5 SUSE:Linux Enterprise Micro 5.3 | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise Micro 5.4 | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise Micro 5.5 | All versions | 1.20.1-150500.3.23.1 |
krb5 SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.16.3-46.24.1 |
krb5 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.20.1-150500.3.23.1 |
krb5 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.16.3-46.24.1 |
krb5 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.19.2-150400.3.24.1 |
krb5 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.20.1-150500.3.23.1 |
krb5 SUSE:Linux Micro 6.0 | All versions | 1.20.1-9.1 |
krb5 SUSE:Linux Micro 6.1 | All versions | 1.21.3-slfo.1.1_5.1 |
krb5 openSUSE:Leap 16.0 | All versions | 1.21.3-160000.4.1 |
krb5 openSUSE:Tumbleweed | All versions | 1.22.2-4.1 |
How do I fix CVE-2026-11850?
Apply the vendor's patch.
Is CVE-2026-11850 being exploited?
There is no known exploitation of CVE-2026-11850 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-11850, DEBIAN-CVE-2026-11850, ECHO-b5cb-5a81-96de, GHSA-85rq-mqr4-hjw7, RHSA-2026:25520, ROOT-OS-DEBIAN-12-CVE-2026-11850 and 9 more.