CVE-2026-68744 is a local information disclosure vulnerability in SSSD's NSS responder component. The sss_nss_protocol_fill_initgr() function pre-allocates reply space for all group entries but fails to shrink the packet when some groups are skipped, resulting in uninitialized heap bytes being sent to the client. A local attacker with access to the SSSD NSS responder unix socket can exploit this to leak cached directory data and heap layout information from the sssd_nss process. Credentials and sensitive secrets are not exposed as they reside in separate processes. The disclosed heap pointers could assist in bypassing ASLR if combined with other memory corruption vulnerabilities. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use and deployment.

The vulnerability allows a local attacker to read uninitialized heap memory from the sssd_nss process, disclosing cached directory data and heap layout information. This does not expose credentials, hashes, or tickets, which are stored in separate processes. The primary impact is low-level information disclosure that could aid in bypassing address space layout randomization (ASLR) if chained with other vulnerabilities. There is no impact on integrity or availability.

Red Hat currently does not provide a mitigation or fix that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since the issue requires local access to the SSSD NSS responder unix socket, restricting local access to this socket may reduce risk. No official patch is available at this time.