An integer underflow in the gss_accept_sec_context() function of MIT Kerberos 5 allows an unauthenticated attacker to trigger an out‑of‑bounds read when the NegoEx mechanism is registered via /etc/gss/mech. This can cause the process handling the request to terminate during parse_message, leading to a denial of service for the affected Kerberos service. The weakness is identified as CWE‑191, which describes integer conversion errors that may result in buffer overruns or truncation.

The vulnerability impacts installations of MIT Kerberos 5 prior to version 1.22.3. Systems that load or register the NegoEx mechanism from /etc/gss/mech are susceptible, regardless of the specific Kerberos service (e.g., KDC, krb5kdc, or client authentication).

The CVSS score is 5.9, indicating a moderate severity. No EPSS score is available, but the vulnerability can be triggered without authentication over the network, implying that an attacker with network access to the Kerberos server could abuse it. The vulnerability is not listed in CISA KEV at this time, although the lack of exploitation evidence does not preclude future use. The surface is limited to machines configured with NegoEx; disabling that mechanism reduces risk.