Skip to main content

SSSD CVE-2026-68742

| EUVDEUVD-2026-52258 MEDIUM
Out-of-bounds Read (CWE-125)
2026-08-03 redhat GHSA-pwm5-x9cm-2ppf
Buffer Overflow Denial Of Service Information Disclosure Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
5.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local socket access with a standard user account is sufficient; impact is purely availability via process crash; no confidentiality or integrity effect is established by description or CVSS.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 03, 2026 - 10:34 vuln.today
CVE Published
Aug 03, 2026 - 09:53 nvd
MEDIUM 5.5

DescriptionCVE.org

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

AnalysisAI

Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function sss_nss_protocol_parse_addr() fails to validate the addrlen field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

SSSD (System Security Services Daemon) is the primary identity and authentication brokering daemon on Red Hat Enterprise Linux, mediating access to LDAP, Kerberos, and local identity sources via the NSS (Name Service Switch) and PAM interfaces. The affected function sss_nss_protocol_parse_addr() processes GETHOSTBYADDR requests - reverse IP-to-hostname lookups - received on the SSSD NSS responder socket. The root cause is CWE-125 (Out-of-bounds Read): the parser reads the addrlen field from the incoming packet and uses it to advance through the buffer without first checking that addrlen bytes remain in the packet body. A crafted packet with an oversized addrlen causes the function to read beyond the allocated buffer boundary, corrupting process state and triggering a crash. The NSS responder socket is accessible to unprivileged local users by design, since ordinary name resolution must function for all accounts. Affected CPEs span cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10 and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.

RemediationAI

Apply the patched SSSD package from Red Hat once errata are released for the applicable RHEL version via yum update sssd or dnf update sssd; monitor https://access.redhat.com/security/cve/CVE-2026-68742 and https://bugzilla.redhat.com/show_bug.cgi?id=2509762 for the specific fixed package version, which was not independently confirmed in available data. As an interim compensating control, restrict access to the NSS responder socket (typically /var/lib/sss/pipes/nss) using filesystem ACLs (setfacl) or a tightened SELinux policy to limit which local users may send requests - note this will break name resolution for restricted users and may cause application failures that depend on SSSD-provided identity data. In high-availability environments, configure a systemd watchdog or automatic restart for the sssd service (Restart=on-failure in the unit file) to minimize downtime following a crash, though this is a resilience measure only and does not prevent exploitation.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-68742 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy