CVE-2026-104030

MediumCVSS 5.5/10Last modified Oct 6, 2026

Description

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 5, 2026
Last modified
Oct 6, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1040315.5A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request procesCVE-2026-1040325.5A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due toCVE-2026-1040335.4A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributesCVE-2026-1040344.7A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-grCVE-2026-1040355.5A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS)CVE-2026-1040365.8A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destinatCVE-2026-1040375.5A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to thCVE-2026-1040385.9A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security CVE-2026-1040394.7A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling GenerCVE-2026-1040406.1A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly CVE-2026-1040415.5A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch CVE-2026-1040425.5A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) re
CVE-2026-104030: Medium severity, CVSS 5.5 | Vulnix