CVE-2026-40355
EUVD-2026-2598128.04.2026, 06:16
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mit | kerberos_5 | 1.18 ≤ 𝑥 < 1.22.3 | CNA |
Common Weakness Enumeration