SSSD CVE-2026-68744

Exploitation requires a local, low-privileged user account on the affected system - as reflected in the CVSS vector PR:L and AV:L. The vulnerability triggers during standard NSS initgroups queries, which any logged-in user can issue implicitly through normal system operations (e.g., su, id, getent). No special configuration beyond SSSD being deployed as the NSS identity source (the default in RHEL domain-joined environments) is required. Exploitation is strictly local; remote unauthenticated exploitation is not possible per the AV:L vector. Limiting factors: the attacker must have an interactive or service account on the system, must be able to invoke NSS queries (standard for any logged-in user), and the information disclosed is limited to partial confidentiality (C:L) - heap bytes and potentially cached directory data. The vulnerability does not provide integrity impact or availability impact, and does not grant elevated privileges on its own.

The CVSS 3.1 score of 3.3 (Low) is consistent with the realistic impact profile. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N places the vulnerability firmly in the local, low-privilege, no-user-interaction category with only partial confidentiality impact and zero integrity or availability impact. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified, making opportunistic mass exploitation unlikely. The primary real-world risk is targeted information disclosure on multi-tenant or shared systems where a low-privileged user could harvest heap addresses from sssd_nss to aid in a follow-on memory-corruption exploit chain, or extract cached directory data such as group names. Standalone, this vulnerability does not grant privilege escalation or code execution. The risk is higher in environments where multiple untrusted local users share a system, such as HPC clusters, container hosts, or shared RHEL servers, but remains low in typical single-tenant deployments.

A low-privileged local user on an RHEL system executes a command such as id or getent initgroups that triggers an NSS initgroups query to the sssd_nss process. The sss_nss_protocol_fill_initgr() function allocates a reply buffer for all candidate groups but skips some entries, leaving uninitialized heap bytes in the padded response sent back to the user process. The attacker reads the raw response buffer to extract heap addresses from sssd_nss, potentially enabling a subsequent ASLR-bypass step in a chained local privilege escalation attempt, or to read cached directory data such as group names not otherwise visible.