CVE-2026-91926 describes a memory leak in the gss-ntlmssp library's NTLM target-info parser. When a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries, the parser allocates memory for each string but fails to free the previous allocation for the same AV_PAIR type. This leads to a memory leak that can be exploited by an attacker controlling the server or acting as a man-in-the-middle to cause gradual memory exhaustion on the client, resulting in denial of service during NTLM authentication.

The vulnerability allows an attacker who can send crafted NTLM CHALLENGE messages to cause a memory leak on the client side. Over time, this can exhaust client memory resources, leading to denial of service. There is no impact on confidentiality or integrity, only availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted NTLM servers or intermediaries to reduce risk.