The vulnerability in MIT krb5's berval2tl_data() function arises from an unsigned subtraction (bv_len - 2) without prior bounds checking. When bv_len is less than 2, the subtraction underflows, wrapping to a large value truncated to uint16_t, causing malloc to allocate a large buffer and memcpy to read beyond the actual buffer size. This results in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len less than 2, which triggers the underflow when the Kerberos KDC or kadmind reads principal data. This affects numerous Ubuntu krb5 package versions as listed.

The vulnerability causes a heap out-of-bounds read, which can lead to denial of service (application crash) or potentially information disclosure. The CVSS vector indicates network attack complexity is high and requires high privileges, with no user interaction needed, and impacts availability severely and confidentiality to a low degree. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted or compromised LDAP KDB backends that could return malformed krbExtraData attributes. Monitor vendor channels for updates and apply patches promptly once released.