CVE-2026-68743
Received Received - Intake

Out-of-Bounds Read in SSSD PAM Responder

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Red Hat, Inc.

Description
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-68743
EUVD
EUVD-2026-52865

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat sssd *
redhat sssd 2.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in SSSD's PAM responder. The extract_authtok_v1() function fails to validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this by sending a crafted protocol v1 request to the PAM responder socket, causing a crash and denial of service.

Detection Guidance

Check if SSSD is running and inspect the PAM responder socket for unauthorized access attempts. Monitor logs for crashes in sssd_pam or sssd processes. Look for protocol v1 requests in logs since protocol v3 is unaffected.

Impact Analysis

The impact is a denial of service for SSSD-mediated authentication. The sssd_pam responder crashes, preventing authentication services. On systems running SSSD 2.10+, the responder runs as an unprivileged user, limiting further damage. Earlier versions may run as root, increasing risk. Persistent outages could occur if the sssd monitor repeatedly respawns the crashed responder.

Mitigation Strategies

No effective mitigation is currently available per Red Hat. Consider restricting local access to the PAM responder socket (/var/lib/sss/pipes/pam) if possible. Monitor for crashes and restart SSSD if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart