CVE-2026-11850

Name of the Vulnerable Software and Affected Versions MIT krb5 (affected versions not specified)

Description An integer underflow occurs in the berval2tl data() function within plugins/kdb/ldap/libkdb ldap/ldap principal2.c. The function executes an unsigned subtraction (bv len - 2) without a bounds check. If bv len is 0 or 1, the result wraps to a large value, which is then truncated to uint16 t, resulting in 0xFFFE (65534) or 0xFFFF (65535). This leads to a successful malloc and a subsequent memcpy that reads up to 65534 bytes from a 0-1 byte buffer, causing a heap out-of-bounds read. This can be triggered when a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with bv len less than 2 while the KDC or kadmind reads principal data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.