Memory Disclosure Vulnerability in GNU SASL by GNU

CVE-2026-56968

What is CVE-2026-56968?

A vulnerability in GNU SASL prior to version 2.2.4 allows for potential memory disclosure. Specifically, the flaw stems from the lack of proper sanitization of a short challenge in the NTLM client function _gsasl_ntlm_client_step, which may be exploited through a crafted server. This could expose sensitive information residing in memory, posing a serious security risk to systems utilizing affected versions of GNU SASL.

References