CVE-2026-11850 is an integer underflow vulnerability in the MIT krb5 LDAP KDB plugin's berval2tl_data() function. The function subtracts two from a BER value length (bv_len) without verifying that bv_len is at least two. If bv_len is 0 or 1, the subtraction wraps around to a large unsigned value, causing malloc to allocate a large buffer and memcpy to read far beyond the actual buffer size. This results in a heap out-of-bounds read, potentially causing crashes or memory corruption. The vulnerability is triggered when a malicious or compromised LDAP KDB backend returns a krbExtraData attribute with length less than two. Exploitation requires control or write access to the LDAP backend used as the Kerberos database. Deployments using file-based KDB backends are not affected. Red Hat classifies this as a moderate severity issue with no current mitigation or fix meeting their standards.

The vulnerability can cause heap out-of-bounds reads leading to crashes or instability of the Kerberos KDC or kadmind services. It may also result in memory corruption. Exploitation requires a malicious or compromised LDAP backend with write access to the Kerberos database, limiting the attack surface. There is no indication of remote code execution or privilege escalation from this vulnerability. The impact is primarily denial of service and potential data corruption within the affected Kerberos services.

Red Hat currently states that no mitigation is available or meets their criteria for ease of use, deployment, and stability. Exploitation requires compromise or write access to the LDAP backend, so securing and monitoring LDAP backend integrity is advisable. Deployments using file-based KDB backends are not affected by this vulnerability. Users should monitor Red Hat advisories for any future patches or mitigations. For affected environments, consider restricting access to the LDAP backend and applying best practices for LDAP security until a fix is released.