CVE-2026-12610

Katalog CVE

CVSS 6.4 · Medium EPSS 0,12%

Kerentanan Expired Pointer Dereference pada fedoraproject sssd, redhat enterprise linux. Skor CVSS 3.1 6.4 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Undergoing Analysis

CVSS 3.1

6.4 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-825: Expired Pointer Dereference

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-12610 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2490288 advisory vendor
• https://github.com/SSSD/sssd/issues/8796 issue tracking · mitigasi