CVE-2026-68744

LowCVSS 3.3/10Last modified Aug 31, 2026

Description

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-687458.1Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent t CVE-2026-687468.8Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access CVE-2026-687476.1Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrre CVE-2026-687497.5Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote atta CVE-2026-68759.5ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could e CVE-2026-687507.5Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacke CVE-2026-687527.2A Project Resource Manager may gain broader administrative privileges under specific conditions.CVE-2026-687535.3An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.CVE-2026-687546.5A repository publisher without delete permission may modify protected package content under specific conditions.CVE-2026-687554.3A bundle writer may create misleading release promotion information under specific conditions.CVE-2026-687566.6A party with write access to stored session data may affect JFrog Artifactory under specific conditions.CVE-2026-687577.5A user with access to a valid SAML response may impersonate another user under specific conditions.