CVE-2026-68744: Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-08-31
Weakness: CWE-908

Description

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

Affected products

[UNKNOWN] sssd: all versions
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0

References

https://access.redhat.com/security/cve/CVE-2026-68744
https://bugzilla.redhat.com/show_bug.cgi?id=2509761

Get alerted when CVE-2026-68744 or the next vulnerability affects your stack