CVE-2026-68743 — Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

USN-8718-1 — sssd vulnerability

Affected: Ubuntu:Pro:16.04:LTS: sssd, Ubuntu:Pro:18.04:LTS: sssd, Ubuntu:Pro:20.04:LTS: sssd, Ubuntu:22.04:LTS: sssd, Ubuntu:24.04:LTS: sssd, Ubuntu:26.04:LTS: sssd

It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service.

Most recent entries from all

CVE-2026-68743 — Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

USN-8718-1 — sssd vulnerability