CVE-2026-68742 is a moderate severity vulnerability in the sss_nss_protocol_parse_addr() function of SSSD's NSS responder. The function fails to validate the addrlen field against the remaining packet size, enabling a local attacker to trigger an out-of-bounds read via a crafted GETHOSTBYADDR request sent to the NSS responder unix socket. This causes a process crash resulting in denial of service. The over-read bytes are used internally as a lookup key and are not returned to the client, limiting impact to availability only. The sssd monitor may respawn the responder, but repeated exploitation can cause persistent name resolution outages for SSSD-managed users. Red Hat currently does not provide a fix or effective mitigation that meets their criteria for ease of use, applicability, and stability.

The vulnerability allows a local attacker with access to the NSS responder socket to cause an out-of-bounds read, leading to a segmentation fault and process crash. This results in denial of service by disrupting name resolution for users managed by SSSD. Confidentiality and integrity are not impacted as the over-read data is not exposed externally. Persistent exploitation can cause ongoing service disruption due to repeated crashes.

Red Hat states that no effective mitigation is currently available that meets their criteria for deployment and stability. Users should monitor Red Hat advisories for future updates or fixes. Since the vulnerability requires local access to the NSS responder socket, restricting local access to trusted users may reduce risk. The sssd monitor may automatically respawn the crashed responder, but repeated crashes can cause persistent outages.