EUVD-2026-92759
GHSA-rwfv-xr9p-g8w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated access
-
DeliveryCraft passkey token lacking null terminators
-
ExploitSubmit token to sssd auth service
-
ExecutionOut-of-bounds read past buffer end
-
Impactsssd process crashes, authentication disrupted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that passkey (FIDO2/WebAuthn) authentication is configured and reachable via sssd, and that the attacker is a local user able to submit a passkey authentication token to the authentication service. The crafted token must specifically lack null terminators to trigger the out-of-bounds read. Limiting factors: the attacker must already have low-privilege local access (PR:L) - there is no remote or unauthenticated path (AV:L); impact is confined to availability (crash of the auth daemon) with no confidentiality or integrity effect; and deployments that do not use sssd's passkey authentication feature are not exposed to this specific code path. |
| Impact | This is a moderate-severity, local-only availability vulnerability (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) in sssd, affecting only availability. The CVSS vector confirms local attack vector (AV:L), low complexity (AC:L), and that the attacker must already hold low privileges (PR:L) - i.e. an authenticated local user. There is no network exposure and no confidentiality or integrity impact. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a genuine but low-priority issue - the local-only vector plus a requirement for existing authenticated access and impact limited to a crash of the authentication daemon make it far less urgent than its CWE-125 class might suggest. CONFLICT TO NOTE: the input Tags list 'Information Disclosure' and 'Buffer Overflow', but the CVSS vector sets C:N (no confidentiality impact) and the description characterizes the flaw strictly as an out-of-bounds read causing a crash/DoS, not an info leak or write-based overflow - the tags overstate the impact relative to the authoritative description and vector. |
| Exploit ScenarioDerived | A local user with the ability to invoke passkey authentication submits a specially crafted passkey authentication token that omits null terminators; sssd reads past the end of the buffer and crashes. This takes down authentication services for the host until the daemon recovers, creating a localized denial of service. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the only references are the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-104030) and Red Hat Bugzilla 2479429 (https://bugzilla.redhat.com/show_bug.cgi?id=2479429), so remediation currently depends on compensating controls until an updated sssd package is published. The most direct mitigation is to disable sssd's passkey/FIDO2-WebAuthn authentication path (for example by removing passkey/WebAuthn configuration from the PAM stack and sssd.conf so the vulnerable token parser is never invoked), with the trade-off that affected hosts lose passkey-based login and must fall back to password, Kerberos or smart-card methods. Where passkeys must remain enabled, restrict interactive local logins to trusted accounts so a low-privileged local user cannot reach the authentication service, understanding that this weakens the host's general local-access model rather than removing the flaw. Operational monitoring should watch for sssd daemon crashes, restarts and authentication outages (journalctl, systemd unit watch on sssd/sssd-kcm) as an indicator that the flaw is being triggered, and administrators should subscribe to the Red Hat advisory for the CVE so the fixed sssd package can be applied as soon as it is released; note that restarting sssd after a crash restores authentication availability but does not remediate the underlying out-of-bounds read.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-125 out-of-bounds read in sssd, Red Hat's System Security Services Daemon, which brokers authentication and identity lookups (LDAP, Kerberos, IPA, Active Directory) for Linux hosts. The affected code path is the passkey/FIDO2-WebAuthn authentication handling that the daemon exposes to local authentication clients; when a supplied passkey authentication token is not null-terminated as the parser expects, the routine reads past the end of the allocated memory buffer while inspecting the token. Because the read occurs beyond the buffer boundary, the process can hit unmapped memory and abort, taking down the authentication service. The CVSS vector AV:L/PR:L confirms the attacker must already hold a local session with low privileges to reach this code path, and the S:U/C:N/I:N/A:H metrics confirm scope is unchanged with impact limited to availability. Red Hat's CPE data scopes affected products to Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4 (which embeds RHEL user space), reflecting that the vulnerable sssd component ships across those platforms rather than a single release.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local user submits the malformed token (AV:L, PR:L, AC:L); out-of-bounds read only crashes the daemon, so A:H with C:N/I:N and no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Exploit-DB