CVE-2023-39975

A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling.

This vulnerability is rated as an Important because a double-free vulnerability was found in krb5 KDC within the TGS processing logic. The flaw is triggered when an authenticated attacker sends a TGS renew or validate request that induces a failure in authorization data handling. This action causes the same memory pointer to be freed twice, leading to a crash, successful exploitation could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.