CVE-2026-107778

{
  "etk_id": "ETK-2026-1053",
  "cve_id": "CVE-2026-107778",
  "display_id": "CVE-2026-107778",
  "ghsa_id": "GHSA-xfjm-wc9w-mmc6",
  "euvd_id": "EUVD-2026-95256",
  "status": "published",
  "anchor_state": "anchored",
  "title": "NULL pointer dereference in MIT krb5 credential processing",
  "summary": "MIT krb5 through 1.22.2 is affected when GSS-API acceptor services process certain forwarded Kerberos credentials. An authenticated client can cause an affected service to crash, resulting in denial of service. Exploitation requires the attacker to authenticate to the relevant Kerberos service.",
  "mitigation": "Limit GSS-API acceptor access to trusted Kerberos principals and restrict forwarded credentials where operationally feasible. Track vendor updates and upgrade to a release identified as fixing the issue; no fixed version is recorded here.",
  "vendor": "MIT",
  "product": "krb5",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.22.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "krb5",
      "purl": null
    }
  ],
  "cwes": [
    476
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0042,
  "epss_percentile": 0.3534,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.943457016666667,
  "t0_at": "2026-10-08T20:15:54.159000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T20:15:54.159000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T20:15:54.159000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107778"
    }
  }
}