VulnerabilityModified

CVE-2015-2698

HIGH 8.5EPSS 2.92%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.

CVSS 2.0: 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
EPSS: 2.92% probability · 87th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-119
Affected: mit/kerberos 5
Source: cve@mitre.org

EPSS trend

EPSS 2.9% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.