SSSD EUVD-2026-52865

The attacker must have local access to the target system with at least low-privilege credentials (PR:L per CVSS vector), sufficient to interact with the SSSD PAM responder Unix socket. The vulnerable code path is triggered specifically when the PAM responder processes a protocol version 1 (v1) authentication request containing a crafted auth_token_length field. Exploitation is limited to local attackers - network-based exploitation is not possible given AV:L. The attack is not automatable per SSVC (Automatable: no), which likely reflects the need to interact with a socket with access controls tied to local user identity. Exploitation is further constrained to systems where SSSD is actively running and the PAM responder is active, which is the default configuration on RHEL deployments using centralized identity providers (LDAP/Kerberos). Systems using only local PAM authentication without SSSD are not affected.

The CVSS 3.1 score of 7.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H reflects local exploitation with low privileges and dual impact: high confidentiality impact (memory disclosure) and high availability impact (process crash). However, the local attack vector (AV:L) meaningfully constrains real-world risk - the attacker must already have a local shell or equivalent socket access on the target system. EPSS at 0.14% (3rd percentile) reinforces that mass exploitation is highly unlikely. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) further deprioritizes this vulnerability for emergency response. No KEV listing and no public POC are present in the available data. Despite the 7.1 CVSS score driven by the C:H and A:H ratings, this is a real-but-not-urgent finding: it matters most on multi-tenant or shared-access systems where local privilege boundaries are critical security boundaries. The C:H rating is notable - SSSD handles Kerberos tickets and cached credentials, so memory disclosed from this process could contain sensitive authentication material.

A local attacker with a low-privilege shell account on a RHEL system constructs a malformed SSSD protocol v1 PAM request in which the auth_token_length field is set to a value far exceeding the actual remaining bytes in the message buffer. When submitted to the SSSD PAM responder socket, extract_authtok_v1() reads beyond the buffer boundary, causing SSSD to crash (denial of service) and potentially exposing memory contents - which on an SSSD process may include cached Kerberos tickets or authentication tokens - to the attacker. No public proof-of-concept code has been identified at time of analysis.