CVE-2026-56968 describes a vulnerability in GNU SASL before version 2.2.4 where the NTLM client fails to properly sanitize a short challenge in the _gsasl_ntlm_client_step function. This lack of validation can lead to memory disclosure when interacting with a maliciously crafted server. The vulnerability is categorized as CWE-839, indicating a numeric range comparison without a minimum check. The CVSS 3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker controlling a server could exploit this vulnerability to cause memory disclosure on a client running a vulnerable version of GNU SASL. The confidentiality impact is limited, and there is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor GNU project advisories for updates and consider avoiding use of vulnerable versions (<2.2.4) until a fix is available.