The SSSD NFS idmap plugin contains an out‑of‑bounds write flaw. When the plugin attempts to copy cached user or group names, it correctly detects when the data exceeds the destination buffer but fails to halt the copy operation. An attacker can trigger the condition by requesting identity lookups that resolve to entries larger than the buffer, causing the plugin to write beyond its bounds. The immediate effect is a crash of the identity mapping service, which manifests as a denial of service. Depending on the memory state, the write may also corrupt adjacent process memory, potentially affecting related services.

Affected products include Red Hat Enterprise Linux sever 6 through 10 and Red Hat OpenShift Container Platform 4. All RHEL releases and OpenShift nodes that host the SSSD service and its NFS idmap plugin are potentially impacted.

The vulnerability has a CVSS score of 5.8, indicating moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. The attack vector requires local access to trigger oversized identity lookups, meaning an attacker typically needs physical or network access to the affected host or a compromised user service that can perform privileged lookups. Once triggered, the exploit causes a service crash and may lead to secondary memory corruption, but no remote code execution is reported.