In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
| Version | Score | Severity | Vector String |
|---|---|---|---|
| 3.1 | 9.1 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | < 10.0.20348.4171 |
| n/a | n/a | all |