CVE-2009-0846

CRITICAL

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of serv...

Affects 9 products across 5 vendors.

CVSS 2.010.0
EPSS8.9%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity.
CWE Weakness Definitions
CWE-824: CWE-824
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2009. A critical vulnerability affects Apple systems (CVE-2009-0846). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2009-GLOBAL-313490-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2009-0846?
This vulnerability was disclosed in 2009. A critical vulnerability affects Apple systems (CVE-2009-0846). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2009-0846?
CVE-2009-0846 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 8.9%.
Is CVE-2009-0846 actively exploited?
No confirmed active exploitation of CVE-2009-0846 as of 2026-09-25.
How do I remediate CVE-2009-0846?
Priority: MEDIUM. Advisory: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt PSIRT: [email protected]
What systems are affected by CVE-2009-0846?
CVE-2009-0846 affects Apple Mac Os X; Canonical Ubuntu Linux; Fedoraproject Fedora; Mit Kerberos 5; Redhat Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation.
Vulnerability Details
CVE IDCVE-2009-0846
BSIDBS-2009-GLOBAL-313490-C BreachSpider Global ID
CVSS VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Published2009-04-09
Last Modified2026-06-16
ICS Relevance0%
Weakness (CWE)
CWE-824
SourceNVD
Official Description

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Apple Mac Os X < 10.5.7
Canonical Ubuntu Linux 6.06 7.10 8.04 8.10
Fedoraproject Fedora 9 10
Mit Kerberos 5 < 1.6.4
Redhat Enterprise Linux 4.0
Redhat Enterprise Linux Eus 4.7
Redhat Enterprise Linux Desktop 3.0 4.0
Redhat Enterprise Linux Server 2.0 3.0 4.0
Redhat Enterprise Linux Workstation 2.0 3.0 4.0
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 6399 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashbab6cae3c0342ea354dab699a6e8e4c5ddd8e9cd44faf71aad50c6e5ff829fd9bf4e36e1ff14e22bb2d4626a8abf4d386b8a18a35674c8ca2ef4911a8165ec90
Related CVEs affecting Apple
CVE-2012-0751 10.0 The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before ... CVE-2011-2452 10.0 Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows,... CVE-2012-4151 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4153 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4159 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a...
View all Apple CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →