This vulnerability involves an integer underflow (CWE-191) in MIT Kerberos 5 prior to version 1.22.3. Specifically, when the gss_accept_sec_context() function is invoked on a system that has the NegoEx mechanism registered, it can lead to an out-of-bounds read due to the underflow condition. This can cause the affected process to crash. The vulnerability is remotely triggerable by an unauthenticated attacker. The CVSS 3.1 base score is 5.9, reflecting medium severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and impact limited to availability (process termination). No official patch or remediation level has been provided by MIT at this time.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service by triggering an out-of-bounds read that terminates the affected process. There is no impact on confidentiality or integrity reported. No known exploits exist in the wild currently.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a fix is released, consider minimizing exposure of affected services that invoke gss_accept_sec_context() with NegoEx mechanisms registered, if feasible.