Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
6 versions affected across 3 products
CVE-2026-68744 Information Disclosure in SSSD NSS Responder via Uninitialized Heap Memory https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68744
Post summary
The text announces CVE-2026-68744, detailing an information disclosure flaw in SSSD NSS Responder caused by uninitialized heap memory, with no exploit, patch, or PoC information included.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fedoraproject | sssd | - | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | openshift_container_platform | 4.0 | - | - |