CVE-2026-42903
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A null pointer dereference vulnerability in Windows Kerberos allows an authorized attacker to perform a Denial of Service (DoS) attack over a network.
Risk Assessment
An authorized attacker can crash the Kerberos service, potentially disrupting authentication in a Windows domain and affecting system availability.
Recommendation
Apply the appropriate Microsoft patch that addresses this vulnerability.
Other vulnerabilities in Windows Kerberos
See all- CVE-2022-37967High
Elevation of privilege vulnerability in Windows Kerberos. It could allow an attacker to gain higher privileges in a domain.
- CVE-2026-62773High
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-62766High
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-62754High
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-62752High
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-47288High
Integer overflow or wraparound vulnerability in Windows Kerberos. Allows an authorized attacker to execute code over an adjacent network.
- CVE-2026-42914Medium
A vulnerability in Windows Kerberos allows an authorized attacker to cause a denial of service over the network via an out-of-bounds read.
- CVE-2026-20849High
Vulnerability in Windows Kerberos relies on untrusted inputs in a security decision. This allows an authorized attacker to elevate privileges over a network.
- CVE-2024-38239High
A vulnerability in Windows Kerberos allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.
- CVE-2023-21817High
An elevation of privilege vulnerability exists in Windows Kerberos. The description lacks technical details, but the vulnerability could allow an attacker to gain elevated privileges in a domain environment.
Original NVD description (English source)
Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.