CVE-2026-104036

Medium · 5.8

CVSS

5.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a background service that handles user names for network file sharing can cause crashes or memory problems when it processes certain large stored entries, interrupting file access for users.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: High
Impact: Denial Of Service
Component: Application
Class: Buffer Overflow
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Out-of-bounds write in SSSD NFS idmap plugin due to size-exceed detection without abort before data copy from oversized cached user or group name entries.

Why it matters to the business

Service crashes disrupt NFS identity mapping and file access workflows; potential adjacent memory corruption can lead to broader system instability in environments relying on SSSD for authentication and mapping.

How an attack unfolds

A local attacker triggers oversized cached name lookups via identity resolution requests; the plugin detects buffer overflow risk but copies data anyway, causing the out-of-bounds write that crashes the service or corrupts memory.

How to fix it

Upgrade SSSD packages to versions containing the corrected NFS idmap plugin buffer handling logic; apply vendor patches as they become available and restart affected services.

How to confirm the fix worked

Verify updated SSSD package versions; test identity lookups with oversized cache entries to confirm no crash or corruption occurs; review plugin source for proper early abort on size mismatch.

Typical attack path

Issue local identity lookup requests resolving to oversized cached entries
Plugin performs size check without aborting copy operation
Out-of-bounds write executes in process memory
Identity mapping service crashes or adjacent memory is corrupted

How to detect it

Search system and service logs for unexpected SSSD or idmap process terminations around identity lookup events; inspect for segmentation faults or memory corruption indicators in process dumps.

What your security team should do

Prioritize patching SSSD on all systems using NFS idmap functionality
Monitor service logs for repeated idmap crashes or restarts
Limit local user access on systems exposing SSSD identity mapping where feasible
Track upstream SSSD releases for the buffer handling fix

The record

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by crashing the identity mapping service, and may also corrupt adjacent process memory.

Affected packages

Ecosystem	Package	Introduced	Fixed