Skip to content
Fencer Vulns
medium 5.0

CVE-2026-11850 json

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

published 2026-06-11 4 mo ago modified 2026-11-07 2 d ago also EUVD-2026-36219

cvss
5.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.

Patch / fix

  • Red Hat Red Hat Hardened Images 1.22.2-8.hum1
  • krb5 Debian 14 1.22.1-3

debian advisories DEBIAN-CVE-2026-11850

  • krb5 Ubuntu 22.04 LTS 1.19.2-2ubuntu0.8
  • krb5 Ubuntu 24.04 LTS 1.20.1-6ubuntu2.7
  • krb5 Ubuntu 26.04 LTS 1.22.1-2ubuntu4.1

ubuntu advisories UBUNTU-CVE-2026-11850

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • krb5 hummingbird 1 1.22.2-8.hum1
  • libkadm5 hummingbird 1 1.22.2-8.hum1
  • krb5-libs hummingbird 1 1.22.2-8.hum1
  • krb5-tests hummingbird 1 1.22.2-8.hum1
  • krb5-pkinit hummingbird 1 1.22.2-8.hum1
  • krb5-server hummingbird 1 1.22.2-8.hum1
  • krb5-server-ldap hummingbird 1 1.22.2-8.hum1
  • krb5-workstation hummingbird 1 1.22.2-8.hum1

red hat advisories RHSA-2026:25520

  • krb5 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 1.19.2-150400.3.24.1
  • krb5 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Server Applications 15 SP7 +1 more 1.20.1-150600.11.19.1
  • krb5 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 1.20.1-150500.3.23.1
  • krb5 Linux Micro 6.0 1.20.1-9.1
  • krb5 Linux Micro 6.1 1.21.3-slfo.1.1_5.1
  • krb5 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.16.3-46.24.1

suse advisories SUSE-SU-2026:2954-1SUSE-SU-2026:2849-1SUSE-SU-2026:2848-1SUSE-SU-2026:2847-1SUSE-SU-2026:22702-1SUSE-SU-2026:22450-1

  • krb5 openSUSE Leap 16.0 1.21.3-160000.4.1
  • krb5 openSUSE Tumbleweed 1.22.2-4.1

opensuse advisories openSUSE-SU-2026:21238-1openSUSE-SU-2026:11177-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11850 updated cvss 5.0

krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

  • Red Hat Enterprise Linux 6 krb5, libkadm5, krb5-libs, krb5-server, krb5-server-ldap, krb5-workstation, +1 more Red Hat Enterprise Linux 7 krb5, libkadm5, krb5-libs, krb5-pkinit, krb5-server, krb5-server-ldap, +1 more Red Hat Enterprise Linux 8 krb5, libkadm5, krb5-libs, krb5-pkinit, krb5-server, krb5-server-ldap, +1 more Red Hat Enterprise Linux 9 krb5, libkadm5, krb5-libs, krb5-pkinit, krb5-server, krb5-server-ldap, +2 more Red Hat Enterprise Linux 10 krb5 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Hardened Images krb5 1.22.2-8.hum1, libkadm5 1.22.2-8.hum1, krb5-libs 1.22.2-8.hum1, krb5-tests 1.22.2-8.hum1, krb5-pkinit 1.22.2-8.hum1, krb5-server 1.22.2-8.hum1, +3 more
    fixed: vendor fix RHSA-2026:25520
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

Affected products

  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-191 Integer Underflow (Wrap or Wraparound)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.