HIGH 7.1 Microsoft

CVE-2025-24528

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Microsoft Security Update 2026-Jan: In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Affected Products

References

Published: 2026-01-13 · Source: Microsoft · Feed updated: 2026-08-10
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-01-13 via Microsoft. Affected: azl3 krb5 1.21.3-2 on Azure Linux 3.0, cbl2 krb5 1.19.4-4 on CBL Mariner 2.0, cbl2 krb5 1.19.4-5 on CBL Mariner 2.0 and 1 more.
vulnfeed aggregates 9044 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.