A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109823 advisory.

    A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8718-1 advisory.

    It was discovered that SSSD did not properly validate authentication token lengths when processing PAM     responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a     denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21748-1 advisory.

    Security issues fixed:

    - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a     process crash       when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922).
    - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a     process crash       when a crafted protocol v1 request is processed (bsc#1273925).
    - CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory     disclosure       from the `sssd_nss` process (bsc#1273924).

    Other updates and bugfixes:

    - Add `systemd-tmpfiles` configuration file to populate `/var/lib/sss` with the correct permissions on     transactional       servers (bsc#1274748).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3797-1 advisory.

    This update for sssd fixes the following issue:

    - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a     process crash       when a crafted protocol v1 request is processed (bsc#1273925).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347042	Unity Linux 20.1070-8ae / 20.1070e Security Update: sssd (UTSA-2026-109823)	Nessus	Unity Linux Local Security Checks	Local	high
344617	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SSSD vulnerability (USN-8718-1)	Nessus	Ubuntu Local Security Checks	Local	high
343953	openSUSE 16: libipa_hbac-devel / libipa_hbac0 / libnfsidmap-sss / etc (openSUSE-SU-2026:21748-1)	Nessus	SuSE Local Security Checks	Local	high
341026	SUSE SLES12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2026:3797-1)	Nessus	SuSE Local Security Checks	Local	high
332086	Linux Distros Unpatched Vulnerability : CVE-2026-68743	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68743

high

Tenable Plugins

high

high

high

high

high