What is CVE-2014-5352?

CVE-2014-5352 is a vulnerability in Mit Kerberos 5. Published 2015-02-19.

Is CVE-2014-5352 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mit Kerberos 5

CVE-2014-5352

The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.

Published 2015-02-19 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 9.0 (High). Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.062 (93.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.062 · newest: 0.062 · change: 0.000

Affected products

Mit Kerberos 5 — versions 1.11, 1.11.1, 1.11.2

Public proof-of-concept exploits

averyth3archivist/nmap-network-reconnaissance

References

lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html (vendor-advisory)
web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt
rhn.redhat.com/errata/RHSA-2015-0794.html (vendor-advisory)
lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html (vendor-advisory)
www.debian.org/security/2015/dsa-3153 (vendor-advisory)
lists.opensuse.org/opensuse-updates/2015-02/msg00044.html (vendor-advisory)
rhn.redhat.com/errata/RHSA-2015-0439.html (vendor-advisory)
lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html (vendor-advisory)
www.mandriva.com/security/advisories (vendor-advisory)
www.ubuntu.com/usn/USN-2498-1 (vendor-advisory)

Frequently asked questions

What is CVE-2014-5352?: CVE-2014-5352 is a vulnerability in Mit Kerberos 5. Published 2015-02-19.
Is CVE-2014-5352 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.