{"id":"CVE-2026-68744","title":"Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply","summary":"A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be tra…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-908"],"vendor":"Red Hat","product":"sssd","affected":["sssd (all versions)","sssd","sssd (all versions)","sssd (all versions)","sssd (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-04T14:19:33.655887Z"},"published":"2026-08-04","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:37:31.138Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68744","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-68744"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509761","label":"RHBZ#2509761"}],"tags":["cve.org"],"epss":0.00133,"epssPercentile":0.02841,"ingestedAt":"2026-11-06T20:03:04.271Z","slug":"CVE-2026-68744","body":"## Overview\n\nA flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.\n\n## Affected\n\n- `sssd (all versions)`\n- `sssd`\n- `sssd (all versions)`\n- `sssd (all versions)`\n- `sssd (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}