CVE-2010-1320

Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 ...

4.0 MediumPublic exploitFix available

Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.

Exploit likelihood

11.9%Down 20.3 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2010-1320
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-1320
Updated: 2026-11-02

EUVDEUVD-2010-1349 No score

Record: EUVD-2010-1349
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xrh6-gg74-rf7v No score

Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 ...

Record: GHSA-xrh6-gg74-rf7v
Updated: 2026-11-02

OSV No score

Record: CVE-2010-1320
Updated: 2026-11-02

OSVDEBIAN-CVE-2010-1320 No score

Record: DEBIAN-CVE-2010-1320
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10004-1 No score

krb5-1.15-1.1 on GA media

These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10004-1
Updated: 2026-11-02

Affected products

mit kerberos 5

Affected packages

Affected packages
Package	Affected	Fixed
`krb5` Debian:12	before 1.8.1+dfsg-2	1.8.1+dfsg-2
`krb5` Debian:13	before 1.8.1+dfsg-2	1.8.1+dfsg-2
`krb5` Debian:14	before 1.8.1+dfsg-2	1.8.1+dfsg-2
`krb5` openSUSE:Tumbleweed From an advisory covering 54 CVEs	before 1.15-1.1	1.15-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	MIT Kerberos 5 - 'src/kdc/do_tgs_req.c' Ticket Renewal Double-Free Memory Corruption	2010-04-20

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-1320 is a medium vulnerability (CVSS 4.0) in Mit Kerberos 5, published April 22, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.9%, the 96th percentile. Fixed in krb5 1.8.1+dfsg-2.

References

Show 66 moreShow less