CVE-2026-104042

Published: Oct 6, 2026Modified: Oct 7, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash.

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (3)

https://access.redhat.com/security/cve/CVE-2026-104042

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2478862

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2478862

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.