CVE-2026-11850 is an integer underflow vulnerability in the berval2tl_data() function of MIT krb5, specifically in the LDAP KDB backend code (plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c). The function subtracts 2 from an unsigned length (bv_len) without verifying that bv_len is at least 2. If bv_len is 0 or 1, the subtraction wraps around to a large unsigned value (0xFFFE or 0xFFFF), which is then truncated to uint16_t. This results in a large malloc allocation and a memcpy operation that reads far beyond the actual buffer size (0 or 1 byte), causing a heap out-of-bounds read. The vulnerability can be exploited when the KDC or kadmind reads principal data from a malicious or compromised LDAP KDB backend that returns a krbExtraData attribute with bv_len less than 2.

The vulnerability allows a heap out-of-bounds read in the Kerberos KDC or kadmind processes when handling LDAP KDB backend data. According to the CVSS vector, the attack requires network access with high attack complexity and privileges (PR:H), no user interaction, and impacts availability (A:H) and confidentiality (C:L) but not integrity. This could lead to denial of service or limited information disclosure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not specify an official fix or workaround at this time. Users should monitor the Red Hat security advisory page for updates and apply any patches or mitigations once available. Until then, restricting access to the LDAP KDB backend and limiting privileges of processes interacting with it may reduce risk.