CVE-2014-9421: The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.1...

Security readout for executives and security teams

This flaw affects older MIT Kerberos 5 code that handles authenticated RPC data. A logged-in remote user could send malformed data that crashes a Kerberos administration daemon, and the CVE says arbitrary code execution may be possible. Because Kerberos often supports core identity services, exposed vulnerable admin components deserve prompt attention. Exposure is most relevant where MIT krb5 administrative/RPC services such as kadmind are reachable by authenticated Kerberos users. Systems using vendor-patched distribution packages may already be remediated, but old or unsupported Kerberos deployments remain plausible. Prioritize remediation for Kerberos servers because identity infrastructure outages can disrupt authentication across the business. Urgency is lower if services are fully patched or tightly isolated, but old reachable kadmind deployments should be treated as high risk. Mitigation focus: Upgrade MIT krb5 to 1.13.1 or a vendor-fixed package.; Apply relevant Red Hat, Debian, Ubuntu, Fedora, SUSE, or MIT advisories.; Restrict kadmind and Kerberos administrative RPC access to trusted networks..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.