CVE-2026-6245
A flaw was found in the System Security Services Daemon (SSSD).
Published Apr 15, 2026 · updated Sep 1, 2026 · fedoraproject sssd
A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 15, 2026 · NIST NVD
Detected
A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially
Sep 1, 2026 · NIST NVD
Updated
A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially
Affected
- cpe fedoraproject/sssdversion unspecified
- cpe redhat/enterprise linux10.0
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux8.0
- cpe redhat/enterprise linux9.0
- cpe redhat/openshift container platform4.0
Sources
- CVE.orgVulnerability recordCVE-2026-6245
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-6245
A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit terminati
nvd.nist.gov