Is CVE-2026-107708 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107708?

CVE-2026-107708 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-107708

Description

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.