Two security flaws were identified in sssd, a system service managing access to remote directories and authentication. The first (CVE-2026-104036) involves an out-of-bounds write in the NFS idmap plugin caused by improper handling of oversized cached entries, leading primarily to denial of service by crashing the identity mapping service and potential memory corruption. The second (CVE-2026-104038) allows a remote denial of service when a certificate lacking an expected Security Identifier (SID) extension is processed in deployments using SID-based certificate mapping, causing the service to crash during authentication or lookup. A patch fixing these issues is available in sssd version 2.9.4-30.oe2403sp1.