---
id: CVE-2022-42898
title: >-
  PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before
  1.20.1 has integer overflows that may lead to remote code execution (in KDC,
  kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which
  have a res…
summary: >-
  PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before
  1.20.1 has integer overflows that may lead to remote code execution (in KDC,
  kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which
  have a res…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-190
  - CWE-190
vendor: mit
product: kerberos_5
affected:
  - 'kerberos_5 >= 1.8, < 1.19.4'
  - kerberos_5 = 1.20
  - heimdal < 7.7.1
  - samba < 4.15.12
  - 'samba >= 4.16.0, < 4.16.7'
  - 'samba >= 4.17.0, < 4.17.3'
patched:
  - kerberos_5 1.19.4
  - heimdal 7.7.1
  - samba 4.17.3
published: '2022-12-25'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:16:52.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-42898'
references:
  - url: 'https://bugzilla.samba.org/show_bug.cgi?id=15203'
    label: cve@mitre.org
  - url: 'https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c'
    label: cve@mitre.org
  - url: >-
      https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202309-06'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202310-06'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20230216-0008/'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20230223-0001/'
    label: cve@mitre.org
  - url: 'https://web.mit.edu/kerberos/advisories/'
    label: cve@mitre.org
  - url: 'https://web.mit.edu/kerberos/krb5-1.19/'
    label: cve@mitre.org
  - url: 'https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt'
    label: cve@mitre.org
  - url: 'https://www.samba.org/samba/security/CVE-2022-42898.html'
    label: cve@mitre.org
  - url: 'https://bugzilla.samba.org/show_bug.cgi?id=15203'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202309-06'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202310-06'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230216-0008/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230223-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://web.mit.edu/kerberos/advisories/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://web.mit.edu/kerberos/krb5-1.19/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.samba.org/samba/security/CVE-2022-42898.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.06473
epssPercentile: 0.93647
ingestedAt: '2026-10-14T19:49:57.528Z'
---

## Overview

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

## Affected

- `kerberos_5 >= 1.8, < 1.19.4`
- `kerberos_5 = 1.20`
- `heimdal < 7.7.1`
- `samba < 4.15.12`
- `samba >= 4.16.0, < 4.16.7`
- `samba >= 4.17.0, < 4.17.3`

## Remediation

Upgrade past the affected range:

- `kerberos_5 1.19.4`
- `heimdal 7.7.1`
- `samba 4.17.3`