CVE-2022-42898: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may

This month

HIGH 8.8UPGRADEUPGRADEUPGRADE

CVE-2022-42898 is a high-severity flaw (CVSS 8.8) affecting kerberos 5, heimdal, samba. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Why this priority

High severity
EPSS top 6%: very likely to be exploited
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	6.9% (top 6%)
CISA exploited list	No
Weakness	CWE-190
Published	2022-12-25
Last modified	2026-10-14

Publisher (CNA): MITRE · Vendor: heimdal project · mit · samba

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-12-25 06:15 UTCPublished CVE record published
2026-10-14 19:16 UTCUpdated Record last modified

mit kerberos 5 UPGRADE

Affected: >= 1.8 and < 1.19.4 · 1.20 · 1.20 beta1

Fixed in: 1.19.4

Safe to downgrade to: a release before 1.8

1. Check installed version

apt-cache policy kerberos-5 || rpm -q kerberos-5 || kerberos-5 --version

2. UPGRADE to 1.19.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade kerberos-5

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade kerberos-5

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 1.8 (Debian / Ubuntu)

apt-cache madison kerberos-5 sudo apt install kerberos-5=<VERSION_BEFORE_1.8> sudo apt-mark hold kerberos-5

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list kerberos-5 sudo dnf downgrade kerberos-5-<VERSION_BEFORE_1.8> sudo dnf versionlock add kerberos-5

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

heimdal project heimdal UPGRADE

Affected: < 7.7.1

Fixed in: 7.7.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy heimdal || rpm -q heimdal || heimdal --version

2. UPGRADE to 7.7.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade heimdal

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade heimdal

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

samba samba UPGRADE

Affected: < 4.15.12 · >= 4.16.0 and < 4.16.7 · >= 4.17.0 and < 4.17.3

Fixed in: 4.15.12, 4.16.7, 4.17.3

Safe to downgrade to: a release before 4.16.0

1. Check installed version

apt-cache policy samba || rpm -q samba || samba --version

2. UPGRADE to 4.15.12 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade samba

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade samba

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.16.0 (Debian / Ubuntu)

apt-cache madison samba sudo apt install samba=<VERSION_BEFORE_4.16.0> sudo apt-mark hold samba

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list samba sudo dnf downgrade samba-<VERSION_BEFORE_4.16.0> sudo dnf versionlock add samba

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-42898?

kerberos 5: upgrade to 1.19.4; heimdal: upgrade to 7.7.1; samba: upgrade to 4.15.12, 4.16.7, 4.17.3. Exact commands for each OS are on this page.

Is CVE-2022-42898 being exploited?

CVE-2022-42898 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-42898 affect?

CVE-2022-42898 affects kerberos 5, heimdal, samba. Severity is high (CVSS 8.8). PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a result

How urgent is CVE-2022-42898?

Priority 59/100. High severity; EPSS top 6%: very likely to be exploited; Public exploit reference

Software pages

Samba vulnerabilities

Related CVEs

CVE-2026-40356 MEDIUM 5.9 UPGRADE In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if
CVE-2026-40355 MEDIUM 5.9 UPGRADE In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_ac
CVE-2024-37371 CRITICAL 9.1 UPGRADE MITIGATE In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message toke
CVE-2024-37370 HIGH 7.5 UPGRADE In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confid
CVE-2024-26462 MEDIUM 5.5 DOWNGRADE MITIGATE Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

References

← Back to latest CVEs