Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-24528

27
FAUCET Score

CVE-2025-24528 is an integer overflow vulnerability in MIT Kerberos 5 (krb5) versions prior to 1.22, specifically within the kdb_log.c component when using incremental propagation. An authenticated attacker can trigger an out-of-bounds write by providing a large update size, leading to a denial-of-service condition by crashing the kadmind daemon. This vulnerability has a CVSS score of 7.1 (HIGH), indicating a network-based attack with high impact on availability and low impact on integrity, requiring low privileges and high attack complexity. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.7, < 1.22CPE match
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
4.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.61%
Probability of exploitation in next 30 days
EPSS Percentile
45.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0061 is in the 41st percentile among its peer group of 1,162 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (15)

codesyspatch availablevia llm_extracted
View patch
esphomepatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: 20902-17084Fixed in: 1.21.3-3
microsoftpatch availablevia msrc
Product: cbl2 krb5 1.19.4-5 on CBL Mariner 2.0Fixed in: 1.19.4-5
microsoftpatch availablevia msrc
Product: azl3 krb5 1.21.3-3 on Azure Linux 3.0Fixed in: 1.21.3-3
microsoftpatch availablevia msrc
Product: 20903-17086Fixed in: 1.19.4-5
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.5.1Fixed in: rhosdt/opentelemetry-rhel8-operator:sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: krb5-0:1.15.1-55.el7_9.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.5.1Fixed in: rhosdt/opentelemetry-target-allocator-rhel8:sha256:cced4191c3e84f44eca2ed486592c473f97fd5cd0941edb9d216051802dad3f7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: krb5-0:1.18.2-31.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: krb5-0:1.21.1-6.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Discovery 1.14Fixed in: discovery/discovery-server-rhel9:sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Discovery 1.14Fixed in: discovery/discovery-ui-rhel9:sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.5.1Fixed in: rhosdt/opentelemetry-collector-rhel8:sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: rhcos

Vendor Advisories (4)

microsoft2026-Jan/CVE-2025-24528Moderate

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Jan 13, 2026
codesysllm-codesys-fe85e88fbae25bb9CRITICAL

HP ThinPro 8.1 SP7 Security Updates

Jun 3, 2025
esphomellm-esphome-ed450ce9fd6a7380CRITICAL

HP ThinPro 8.1 SP7 Security Updates

Jun 3, 2025
redhatCVE-2025-24528Moderate

krb5: overflow when calculating ulog block size

Jan 28, 2024

References

lists.debian.org / debian-lts-announce/2025/02/msg00029.html
github.com / krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0
github.com / krb5/krb5/compare/krb5-1.21.3-final...krb5-1.22-final