An integer underflow occurs in the berval2tl_data() function of MIT krb5, from which the library blindly subtracts 2 from a length value that may be zero or one. The subtraction wraps to a large number, the result is truncated to a 16‑bit value, and a malloc followed by a memcpy reads up to 65534 bytes from a buffer that actually contains one or fewer bytes. This heap out‑of‑bounds read can expose data residing in adjacent memory and may allow an attacker to gather sensitive information. The weakness is a classic integer underflow (CWE‑191).

The vulnerability surfaces in all Red Hat‑maintained products that ship the MIT krb5 implementation, including Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. No specific minor version constraints are listed, so any release that contains the affected krb5 library is considered vulnerable.

The CVSS score is 5, categorizing the flaw as medium severity, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The attack requires a malicious or compromised LDAP KDB backend that can return a krbExtraData attribute with a length less than two. When a KDC or kadmind reads principal data, the underflow is triggered. Thus the exploitation vector hinges on the ability to manipulate LDAP attributes, which typically demands privileged or administrative access to the LDAP server rather than a publicly reachable network interface.