SSSD CVE-2026-104036

Exploitation requires local access with low privileges (CVSS PR:L) on a host running SSSD whose NFS idmap plugin is in use (typically NFSv4 ID mapping via sssd), and specifically depends on the presence of cached user or group name entries that exceed the plugin's destination buffer size - the attacker must be able to request identity lookups that resolve to such oversized cached entries. Limiting factors: no network vector (AV:L, must be local), valid prior authentication is needed, and high attack complexity (AC:H) because the oversized-cached-entry precondition is not guaranteed in default environments; the realistic outcome is a service crash (DoS) rather than reliable privilege escalation or code execution.

This is a moderate-severity, local-only issue that does not rise to emergency priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 5.8) is internally consistent with the description: a local attacker (AV:L) who already holds valid low-privilege access (PR:L) can trigger an out-of-bounds write (CWE-787) in SSSD's NFS idmap plugin, but only under conditions that make it non-trivial (AC:H) - namely the existence of oversized cached user/group entries that the lookup resolves to. The dominant impact is availability (A:H, crash of the identity-mapping service), with only partial confidentiality/integrity impact (C:L/I:L) from possible adjacent memory corruption. No EPSS score, CISA KEV listing, SSVC decision, or POC was provided in the input; per precedent, there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are not conflicting - they consistently point to a local DoS primitive rather than a remotely weaponizable RCE. Memory corruption flaws can occasionally be escalated beyond DoS, but nothing in the supplied data substantiates reliable code execution. Net: a legitimate patch-management item, not a drop-everything vulnerability.

A low-privileged local user on a RHEL host running SSSD with the NFS idmap plugin issues identity lookups (e.g., for NFSv4 ID mapping) that resolve to cached user or group names larger than the destination buffer. The plugin detects the oversize condition but copies anyway, producing an out-of-bounds write that crashes the identity-mapping service and can corrupt adjacent process memory. No public exploit code was identified in the provided data, and the high attack complexity (dependence on oversized cached entries) limits reliability.