CVE-2026-6245

Name of the Vulnerable Software and Affected Versions System Security Services Daemon (SSSD) (affected versions not specified)

Description A flaw exists in the System Security Services Daemon (SSSD) where the pam passkey child read data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. The data is treated as a NUL-terminated C string without explicit termination, leading to an out-of-bounds read when processed by functions such as snprintf(). A local attacker could trigger this by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash and resulting in a local Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.