6.4
CVE-2026-12610
- EPSS 0.16%
- Veröffentlicht 30.06.2026 08:27:01
- Zuletzt bearbeitet 30.06.2026 20:08:54
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginSssd: use-after-free crash in sssd' 'sssd_pam' process
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Sssd Version-
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
Redhat ≫ Enterprise Linux Version10.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.05 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| secalert@redhat.com | 6.4 | 0.5 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-825 Expired Pointer Dereference
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
https://access.redhat.com/security/cve/CVE-2026-12610
https://bugzilla.redhat.com/show_bug.cgi?id=2490288
https://github.com/SSSD/sssd/issues/8796