CVE-2026-11850: MIT krb5 Integer Underflow in LDAP KDB Plugin

Technical summary

The vulnerability exists in berval2tl_data() within plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned integer subtraction (bv_len - 2) on an untrusted value without first validating that bv_len is at least 2. When bv_len is 0 or 1, the result wraps due to unsigned arithmetic semantics, producing 0xFFFE or 0xFFFF respectively after uint16_t truncation. Subsequent malloc and memcpy operations treat this wrapped value as a legitimate size, causing an out-of-bounds heap read. The attack surface is activated when a KDC or kadmind process loads a principal object from an LDAP directory that has been poisoned or misconfigured to return a malformed krbExtraData attribute.

Business impact

Organizations deploying MIT krb5 with LDAP KDB backends—common in enterprise environments using centralized directory infrastructure—face two key risks. First, an attacker or insider who can modify LDAP entries could trigger heap memory disclosure, potentially exposing session keys or other sensitive authentication material cached in the KDC's memory. Second, the out-of-bounds read can crash kadmind or the KDC process, resulting in authentication service unavailability and blocking all Kerberos-dependent services until the daemon restarts. For critical infrastructure or financial services relying on Kerberos for SSO, even brief outages are operationally significant.

Affected systems

MIT krb5 installations using LDAP for KDB (key distribution backend) storage are in scope. This typically includes enterprise deployments where the KDC and/or kadmind daemons are configured with LDAP plugin support to centralize principal management. The vulnerability does not affect krb5 deployments using file-based or non-LDAP KDB backends. The precise affected versions are not specified in available advisories; verify against the MIT krb5 vendor advisory and your deployment's version string.

Exploitability

Exploitability requires elevated privileges or compromised LDAP directory access. Per the CVSS vector, the attack requires high privilege (PR:H), meaning the attacker must either have LDAP write permissions or control the LDAP server itself. Network accessibility is present (AV:N), but the high complexity requirement (AC:H) and high privilege gate suggest this is not a trivial remote exploit for typical environments. However, insider threats and supply-chain compromises of LDAP backends represent credible scenarios. The vulnerability is not listed on CISA's KEV catalog, indicating no known active public exploitation to date.

Remediation

Await and apply patches from MIT krb5 as they become available; check vendor advisories for specific version numbers. In the interim, reduce attack surface by: (1) restricting LDAP write access to trusted administrators only; (2) implementing LDAP ACLs to prevent unauthorized modification of krbExtraData attributes; (3) monitoring LDAP replication and attribute changes for anomalies; (4) if feasible, running KDC and kadmind on isolated networks with minimal LDAP client exposure. Note that disabling LDAP KDB entirely may not be practical for large deployments, so layered defenses are recommended.

Patch guidance

Monitor MIT krb5 security advisories and vendor release notes for patches addressing CVE-2026-11850. When available, patches will likely be delivered in a stable point release; apply during a scheduled maintenance window. Coordinate patching with LDAP server maintenance to minimize authentication service disruption. Verify patch effectiveness by confirming the berval2tl_data() function now includes bounds checking before the subtraction operation. Test in a non-production environment first to ensure compatibility with existing LDAP configurations.

Detection guidance

Monitor KDC and kadmind process crashes or restarts, particularly if correlated with LDAP queries or principal data reloads. Enable debug logging in krb5 to capture any errors related to principal unmarshalling or LDAP attribute parsing. Network-level detection is limited; focus on LDAP audit logs to identify unusual or malformed attribute values in krbExtraData. Heap memory dumps or crash reports from KDC processes may show corruption patterns consistent with oversized memcpy operations. Endpoint detection and response (EDR) tools can flag unexpected process terminations or memory access violations in krb5 daemons.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt attention in environments using LDAP KDB because: (1) impact includes both confidentiality and availability; (2) KDC/kadmind unavailability is operationally critical; (3) Kerberos environments are high-value targets for lateral movement; (4) insider and supply-chain risk vectors are increasingly relevant. Organizations should prioritize patching LDAP-enabled krb5 deployments over non-LDAP or development instances.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects: low attack complexity impact due to high privilege requirement (PR:H), network reachability (AV:N), and high complexity (AC:H) limiting likelihood. However, the scope is unchanged and availability impact is high (A:H). The low confidentiality impact (C:L) acknowledges potential memory disclosure rather than guaranteed data exfiltration. This score appropriately captures a vulnerability requiring attacker sophistication or insider access but with significant operational consequences if triggered.

Frequently asked questions