Search: CVE-2026-40356

CVE-2026-40356 is an integer underflow vulnerability in MIT Kerberos 5 versions before 1.22.3. It occurs when gss_accept_sec_context() is called on a system with a NegoEx mechanism registered, causing an out-of-bounds read. An unauthenticated remote attacker can trigger this, potentially causing the affected process to terminate unexpectedly. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.