EUVD-2026-52576
GHSA-xxfg-88q3-gxgm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local access with low privilege required to trigger an NSS query; only partial confidentiality impact from heap leak; no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
AnalysisAI
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
Technical ContextAI
SSSD (System Security Services Daemon) is the central daemon on Linux systems for resolving identity, authentication, and group membership from sources such as LDAP, Active Directory, and Kerberos. The vulnerable function sss_nss_protocol_fill_initgr() handles the NSS responder protocol for initgroups queries - determining all supplementary group memberships for a given user. The root cause is CWE-908 (Use of Uninitialized Resource): the function allocates heap space assuming all candidate group entries will be included in the reply, but when entries are skipped (for example, due to group filtering or policy), the buffer is not resized or zeroed before transmission. The resulting packet includes trailing uninitialized heap bytes that the sssd_nss process never intended to expose. Affected CPE strings confirm all major RHEL generations (6, 7, 8, 9, 10) and Red Hat OpenShift Container Platform 4 are impacted, meaning any system using SSSD for identity resolution - which includes the vast majority of enterprise RHEL deployments - carries this exposure.
RemediationAI
Monitor the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-68744 for SSSD errata packages and apply the updated sssd package for the applicable RHEL version once released. No exact fix version is confirmed in the currently available data - availability should be verified via Red Hat's errata tracker or subscription portal. As a compensating control, restrict local user account creation and limit which accounts can trigger NSS initgroups lookups on sensitive systems. Administrators may also configure SSSD group filtering or enumeration restrictions to reduce the set of groups pre-allocated in replies, which may reduce exposure in the skipped-entry path; however, this trade-off can affect legitimate group resolution for authorized users. Environments with strict directory data confidentiality requirements should audit which local accounts exist on SSSD-integrated systems and remove unnecessary accounts until a patch is applied.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today