CVE-2014-5355

CVE-2014-5355 describes a denial-of-service vulnerability in MIT Kerberos 5 versions through 1.13.1. This flaw arises from incorrect handling of the krb5_read_message data field, specifically its expectation of a null-terminated string. Attackers can trigger a NULL pointer dereference or an out-of-bounds read by providing a zero-byte version string or omitting the null terminator, respectively. The vulnerability has a CVSS score of 5.0, indicating a medium severity with low attack complexity and no authentication required, leading to partial availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.