Loading story…
A vulnerability tracked as CVE-2008-0062 was disclosed in the KDC component of MIT Kerberos 5, affecting krb5kdc when handling certain Kerberos 4 message types. The flaw stems from a failure to set a global variable, allowing a remote attacker to send crafted messages that trigger a NULL pointer dereference or double-free condition. Successful exploitation can crash the Kerberos Key Distribution Center, causing a denial of service, and the CVE record notes that arbitrary code execution may also be possible.
Downstream vendors and Linux distributions issued security advisories and package updates in response, including notices from Fedora and Mandriva. The coordinated advisories indicate that patched Kerberos packages were released to address the defect across affected platforms, underscoring the risk to organizations relying on Kerberos-based authentication infrastructure and the need to update exposed KDC systems promptly.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2008-0062 was updated after its initial publication. The update date recorded in the source is 2018-10-15.
MITRE published CVE-2008-0062 for a vulnerability in the krb5kdc component of MIT Kerberos 5. The flaw involves failure to set a global variable for some Kerberos 4 message types, enabling crafted messages to trigger a NULL pointer dereference or double-free condition that can cause denial of service and possibly code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updates for two Moderate-severity MIT Kerberos 5 GSS wrap-token vulnerabilities, **CVE-2024-37370** and **CVE-2024-37371**. A network attacker able to modify a valid token in transit can alter its plaintext Extra Count field, causing the receiving application to interpret the unwrapped message as truncated. The resulting handling errors can disrupt application-layer services; CVE-2024-37370 carries a CVSS 3.1 score of 7.5 and may expose authentication-token data, while CVE-2024-37371 is rated 6.5 and is primarily assessed as an availability risk. The fixes are delivered through Red Hat krb5 advisories including **RHSA-2024:5625** for supported RHEL 8.6 ELS, AUS, telecommunications, and SAP update-service offerings, with `krb5-1.18.2-16.el8_6.1`, and **RHSA-2024:5884** for RHEL Server AUS 8.2, with `krb5-1.17-19.el8_2.1`. Red Hat reported no qualifying standalone mitigation, so administrators should apply the applicable krb5 package updates across affected RHEL systems.
Aug 27, 2026
Microsoft published security advisories for two Windows denial-of-service vulnerabilities affecting core platform components: **CVE-2025-21350** in **Windows Kerberos** and **CVE-2025-59198** in the **Windows Search Service**. The flaws were listed in the Microsoft Security Response Center's Security Update Guide as separate issues impacting authentication and search functionality within Windows environments. The advisories provide official tracking and patch guidance for organizations running affected Windows systems, highlighting the risk that attackers could disrupt service availability rather than execute code or elevate privileges. Security teams should review the relevant MSRC entries, determine exposure across domain-connected and endpoint systems, and prioritize remediation for assets that rely heavily on Kerberos authentication or Windows Search operations.
Jul 12, 2026
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026