The vulnerability resides in the policy RPC stubs of MIT Kerberos 5 (krb5) version 1.5.3 and newer. The stubs fail to reject a NULL policy name decoded by xdr_nullstring(), allowing a remote user who has already authenticated to kadmind to send a policy request with an empty policy name. When the request reaches the authorization checks or logging code, a NULL pointer dereference occurs and kadmind crashes. The result is a denial of service (DoS) that can be triggered by any privileged user of the Kerberos administration service. The weakness is a classic NULL pointer dereference (CWE‑476).

All Red Hat Enterprise Linux releases from version 6 through version 10, as well as the Red Hat Hardened Images and the Red Hat Enterprise Linux Extended Life Cycle (ELS) releases for 6 and 7, are affected. The specific CPEs that illustrate the scope include redhat:enterprise_linux:6, redhat:enterprise_linux:7, redhat:enterprise_linux:8, redhat:enterprise_linux:9, redhat:enterprise_linux:10, redhat:hummingbird:1, rhel_els:6, and rhel_els:7. No fixed versions are listed in the current advisory; affected systems should therefore consider all installations of these products as vulnerable until a patch is issued.

The CVSS v3.1 score of 6.5 indicates medium severity. The EPSS score is not available, and the vulnerability is not currently catalogued in the CISA KEV list, suggesting no widespread exploitation is reported. Nevertheless, the attack requires a remote authenticated connection to kadmind, which many organizations expose to trusted hosts only. An attacker who can authenticate, either legitimately or via credential compromise, can trigger the crash and interrupt Kerberos administrative functions, potentially impacting service availability. Given the medium severity and the limited exploitation prerequisites, the risk is moderate but should be mitigated promptly to avoid denial of service in critical environments.