EUVD-2026-92913
GHSA-wxvg-2hw7-58q4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to NSS responder socket
-
DeliverySend request with undersized packet header
-
ExploitTrigger integer underflow in parser
-
ExecutionOut-of-bounds read crashes responder
-
ImpactName-resolution Denial of Service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the host and the ability to communicate with the SSSD NSS responder UNIX socket (typically reachable by local users/processes on a system where SSSD provides NSS name resolution). The attacker must send a crafted request containing an undersized/malformed packet header to trigger the integer underflow. Limiting factors: no remote network vector (AV:L), prior local access with at least low privilege is needed (PR:L), and the impact is confined to availability - a responder crash/DoS - with no confidentiality or integrity consequence. Hosts not running SSSD, or where the NSS responder is not in use, are not affected. |
| Impact | This is a genuine but modest-severity issue best treated as a hardening/patch-management item rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 Medium) tells a consistent story: exploitation is purely local (AV:L), requires some level of existing access/privilege (PR:L) - specifically the ability to reach the NSS responder UNIX socket - and produces availability-only impact (A:H) with no confidentiality or integrity loss (C:N/I:N). The description corroborates every CVSS metric: a local attacker crashes the SSSD NSS responder via an integer underflow leading to an out-of-bounds read, i.e. a Denial of Service. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this means 'no public exploit identified at time of analysis.' There is no signal conflict between the CVSS vector and the description - both point to local, low-privilege, availability-only impact. The main caveat is the tag set, which lists 'Information Disclosure' and 'Buffer Overflow' despite the description and CVSS (C:N) describing only a crash/DoS from an out-of-bounds read; these tags overstate the impact. Overall: real and worth patching in change windows, but not a high-urgency, remotely exploitable threat. |
| Exploit ScenarioDerived | A local user (or a compromised low-privilege service account) with access to the SSSD NSS responder UNIX socket sends a specially crafted request with an undersized packet header. The malformed header triggers an integer underflow during packet parsing, causing an out-of-bounds memory read that crashes the responder process and denies name-resolution services (users, groups, netgroups) to the host until SSSD restarts. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
RemediationAI
Apply the updated sssd packages once Red Hat publishes them for the relevant RHEL 6/7/8/9/10 and OpenShift Container Platform 4 release streams, tracking availability through https://access.redhat.com/security/cve/CVE-2026-104043 and https://bugzilla.redhat.com/show_bug.cgi?id=2478852; no vendor-released patch version was identified in the provided data, so verify the fixed build in the advisory before upgrading, then restart the daemon (systemctl restart sssd) so sssd_nss picks up the fix. Where immediate patching is not possible, reduce exposure rather than blocking the socket outright: the NSS responder socket (/var/lib/sss/pipes/nss, mode permitting lookup by local consumers) cannot simply be chmod-restricted without breaking name resolution for local users and applications, so the practical controls are tightening SELinux confinement of untrusted local processes, limiting which local accounts and containers can run on identity-serving hosts, and enabling monitoring/alerting on sssd_nss crashes (core dumps, systemd/journal records of respawns) so an exploitation attempt is detected and the responder is restarted; note that such monitoring and restart measures only shorten outage windows and do not remove the parsing bug, so upgrading remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SSSD (System Security Services Daemon) brokers identity and authentication lookups for local consumers through specialized responder processes; the NSS responder (sssd_nss) answers getpwnam/getgrnam-style queries over a UNIX domain socket, typically /var/lib/sss/pipes/nss, and inter-process messages are exchanged as length-prefixed binary packets. The vulnerability is rooted in insufficient validation of the declared packet length: a request with an undersized header causes an integer underflow in the size calculation, so the parser then reads beyond the boundaries of the received buffer. This maps to CWE-125 (Out-of-bounds Read) arising from a CWE-191-style integer underflow, and the practical consequence is a crash of sssd_nss rather than memory corruption that could be leveraged for code execution, which is consistent with the assessed vector showing no confidentiality or integrity impact (C:N/I:N/A:H). The local attack vector and low privileges required (AV:L, PR:L) reflect that the NSS socket is reachable by ordinary local users and processes on systems where SSSD provides name resolution, whereas remote network exposure is not part of the threat model.
Know when Sssd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local socket access needed so AV:L and PR:L; reliable crash gives AC:L and A:H; out-of-bounds read only crashes the process, so C:N/I:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in SSSD Multiple Security Flaws
View all 15A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cach
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whic
Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Servic
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker wh
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS re
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM res
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uid
Exploit-DB