Skip to main content

SSSD CVE-2026-12610

| EUVDEUVD-2026-40268 MEDIUM
Expired Pointer Dereference (CWE-825)
2026-06-30 redhat GHSA-f953-7679-xc38
Privilege Escalation Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Openshift Container Platform 4
6.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Local-only vector, high complexity for heap control, high privileges required to manipulate YubiKey contents; CIA:H reflects crash-to-escalation potential confirmed by vendor.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 30, 2026 - 10:23 vuln.today
CVE Published
Jun 30, 2026 - 08:27 nvd
MEDIUM 6.4

DescriptionCVE.org

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

AnalysisAI

Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.

Technical ContextAI

SSSD (System Security Services Daemon) is the Linux user-space daemon responsible for brokering PAM authentication against remote identity providers such as LDAP, Active Directory, and Kerberos. Its PAM responder component handles smartcard and hardware token authentication flows, including YubiKey integration via the PKCS#11 interface. CWE-825 (Expired Pointer Dereference, a use-after-free subclass) indicates that a memory pointer is retained and dereferenced after the associated memory region has been freed during YubiKey authentication processing. This class of bug occurs when object lifetimes are mismanaged - a pointer to a freed structure is used in a subsequent code path, producing undefined behavior ranging from a clean crash (DoS) to arbitrary code execution under controlled heap conditions. The affected CPE strings span cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10, indicating the bug exists across all currently supported and legacy RHEL major versions.

RemediationAI

No specific patched SSSD package version is identified in the available reference data - patch availability should be verified directly against the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-12610 and the upstream SSSD issue tracker at https://github.com/SSSD/sssd/issues/8796. Once a patched SSSD package is released via Red Hat errata, apply it through standard yum or dnf update channels. As a compensating control, organizations that do not actively use YubiKey or smartcard authentication via SSSD can disable the PKCS#11 or smartcard authentication path in sssd.conf by removing or commenting out pam_cert_auth = True and related certificate authentication directives, then restarting sssd; this eliminates the vulnerable code path entirely but disables hardware token MFA for all users. Restricting physical access to YubiKey devices and limiting which local accounts have permission to invoke smartcard authentication flows provides additional depth. If authentication availability is critical, deploy a secondary authentication path (e.g., local PAM fallback) so an SSSD crash does not cause a complete authentication outage.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-12610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy