CVE-2026-90994
Received Received - Intake

Out-of-Bounds Read in SSSD PAM Responder

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: redhat-SADP

Description
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90994
EUVD
EUVD-2026-77588

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat sssd *
red_hat sssd 2.12.0-1.el10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the System Security Services Daemon (sssd), specifically in the PAM responder's protocol v1 parser function pam_parse_in_data(). A local attacker with access to the PAM responder's UNIX socket can exploit it by sending an empty or truncated PAM request body after negotiating protocol v1. This triggers an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

Detection Guidance

To detect this vulnerability, monitor the sssd PAM responder process for crashes or restarts. Check logs for out-of-bounds read errors in pam_parse_in_data(). Verify if local clients can access the PAM responder UNIX socket at /var/lib/sss/pipes/pam. Use commands like 'ss -lp | grep pam' or 'lsof /var/lib/sss/pipes/pam' to check socket access.

Impact Analysis

The impact is limited to local denial of service. An attacker with local access to the PAM responder's UNIX socket could cause the sssd service to crash or restart repeatedly, disrupting authentication services on the affected system. This could prevent users from logging in or accessing network resources.

Compliance Impact

This vulnerability primarily causes a local denial of service by crashing the PAM responder, which does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA. However, repeated DoS conditions could disrupt authentication services, potentially affecting access controls or audit logging if systems become unstable.

Mitigation Strategies

Restrict access to the PAM responder UNIX socket by setting strict file permissions (e.g., chmod 600 /var/lib/sss/pipes/pam). Disable protocol v1 negotiation if possible by updating sssd configuration. Monitor the PAM responder process for unexpected terminations. Consider isolating affected systems until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart