CVE-2023-39975: Mit Kerberos 5

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.

Affected products

• Mit Kerberos 5: from 1.21, before 1.21.2 (fixed in 1.21.2)

Published 2023-08-16. Last modified 2026-06-17.