CVE-2026-68744 is a local information disclosure vulnerability in Red Hat Enterprise Linux 10's SSSD component. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but fails to shrink the packet when some groups are skipped, resulting in uninitialized heap bytes being sent to clients. A local attacker with access to the SSSD NSS responder unix socket can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. Credentials and sensitive authentication data are not exposed as they reside in separate processes. The primary risk is that leaked heap pointers could assist in bypassing ASLR if chained with other vulnerabilities. Red Hat has not provided a patch or effective mitigation at this time.

The vulnerability allows a local attacker with access to the SSSD NSS responder unix socket to obtain uninitialized heap memory contents from the sssd_nss process. This memory disclosure includes cached directory data and heap layout pointers but does not expose credentials, hashes, or tickets. The information leak is limited to confidentiality impact with no integrity or availability effects. The disclosed heap pointers could facilitate exploitation of other memory corruption vulnerabilities by aiding ASLR bypass. There are no known exploits in the wild. The CVSS v3.1 score is 3.3 (Low severity) reflecting limited impact and local attack vector.

Red Hat currently does not offer a fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates regarding patches or mitigations. Since the issue requires local access to the SSSD NSS responder unix socket, restricting local access to trusted users can reduce risk. No official workaround is available at this time.