The issue lies in the xdr_krb5_tl_data() routine of the MIT Kerberos 5 library. When an encoded Kerberos administration request fails to decode, the routine fails to free partially decoded data. This memory leak allows an authenticated Kerberos client to send crafted RPC requests that grow the kadmind process’s memory usage over time, eventually exhausting system resources and causing a denial of service. The weakness is a classic example of missing release of memory, identified as CWE‑772.

Red Hat Enterprise Linux versions 6, 7, 8, 9 and 10, as well as Red Hat Hardened Images (Hummingbird) are affected. The vulnerability is present in the kadmind component of each distribution’s Kerberos implementation. Version control information is tied to the specific RHEL releases listed here.

The CVSS score of 6.5 indicates moderate severity. The EPSS value is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploit activity so far. The attack requires the attacker to authenticate to the Kerberos service and send specially crafted requests to kadmind. Because the vulnerability only causes a service degradation in the form of a memory leak, it does not confer direct lateral movement or data exfiltration capabilities. However, sustained exploitation can lead to denial of Kerberos services for legitimate users, impacting authentication across the network.