SSSD EUVD-2026-92912

Requires an existing local, low-privilege account on a host where SSSD handles PAM authentication (PR:L, AV:L) and the ability to send a PAM request to the SSSD responder socket; the trigger is specifically a PAM request containing a zero-length authentication token, which the responder fails to length-validate. No non-default configuration is needed beyond SSSD being used for PAM/authentication (its standard role on domain-joined RHEL/OpenShift systems). Limiting factors: the attack is local-only (not remotely reachable), requires prior authenticated access, needs no user interaction, and yields only a responder crash (availability) rather than privilege escalation, code execution, or data disclosure.

This is a moderate-severity local Denial of Service, not a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a local, already-authenticated low-privilege user (PR:L) triggers an out-of-bounds read (CWE-125) that crashes the SSSD PAM responder, yielding availability-only impact (A:H; C:N/I:N). No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical ceiling on risk is the local-only attack vector and the DoS-only outcome - an attacker must already have a local account, and the payoff is a crash of the authentication responder rather than code execution or data theft. Note a signal conflict: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the vendor CVSS sets C:N and the root cause is an out-of-bounds READ causing a crash, not a write/overflow or confirmed data leak - the tags overstate the impact relative to the authoritative CVSS and description. The real-world significance is that a crashed PAM responder can block authentication for legitimate users on a domain-joined host, so on shared multi-user systems this is a meaningful availability concern despite the modest score.

A local user with a shell on a RHEL/OpenShift host running SSSD connects to the PAM responder socket and sends a crafted PAM request carrying a zero-length authentication token. Because the token length is not validated, the responder reads beyond the buffer and crashes, disrupting PAM-based authentication for other users on that host. No public exploit code is identified at time of analysis, and the local, low-privilege attack vector means the attacker must already have an account on the target.