CVE-2026-68744

Name of the Vulnerable Software and Affected Versions SSSD (affected versions not specified)

Description A flaw exists in the NSS responder where the sss nss protocol fill initgr() function pre-allocates reply space for all group entries but fails to shrink the packet when groups are skipped. This results in the transmission of uninitialized heap bytes to the client. A local attacker can exploit this behavior to disclose cached directory data and heap layout information from the sssd nss process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.