This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-104043 →

DEBIAN-CVE-2026-104043

A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by send...

Original description

The description as published by the source.

A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 sssd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 sssd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org