CVE-2026-42903
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A null pointer dereference vulnerability in Windows Kerberos allows an authorized attacker to perform a Denial of Service (DoS) attack over a network.
Risk Assessment
An authorized attacker can crash the Kerberos service, potentially disrupting authentication in a Windows domain and affecting system availability.
Recommendation
Apply the appropriate Microsoft patch that addresses this vulnerability.
Other vulnerabilities in Windows Kerberos
See all- CVE-2026-83720High
A use after free vulnerability in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-70241High
Use after free vulnerability in Windows Kerberos. An authorized attacker can exploit it to elevate privileges locally.
- CVE-2026-70064High
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-108132High
A double free vulnerability in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2022-37967High
Elevation of privilege vulnerability in Windows Kerberos. It could allow an attacker to gain higher privileges in a domain.
- CVE-2026-69822High
Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-69760High
Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network.
- CVE-2026-69744High
Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network.
- CVE-2026-69685High
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-69676High
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

