A flaw in the System Security Services Daemon (SSSD) causes an out‑of‑bounds read when pam_passkey_child_read_data() processes raw bytes from a pipe as a NUL‑terminated C string. The missing explicit termination leads to a crash when functions such as snprintf() read past the buffer end, allowing a local attacker to trigger a passkey authentication request that crashes the PAM responder and results in a denial of service.

The vulnerability affects Red Hat Enterprise Linux 10, 6, 7, 8, 9 and Red Hat OpenShift Container Platform 4, specifically systems that have the PAM passkey authentication module enabled.

With a CVSS score of 5.5 the severity is moderate. Exploitation requires local access to craft a passkey request; no publicly available exploit code is known and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of exploitation in the wild, but any local attacker could cause service disruption.