GNU SASL <2.2.4 NTLM Challenge Sanitization Flaw (Memory Disclosure)
CVE-2026-56968 Published on June 23, 2026
GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.
Vulnerability Analysis
CVE-2026-56968 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is a Signed comparison Vulnerability?
The program checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
CVE-2026-56968 has been classified to as a Signed comparison vulnerability or weakness.
Products Associated with CVE-2026-56968
Want to know whenever a new CVE is published for Gnu Sasl? stack.watch will email you.
Affected Versions
GNU SASL:- Before 2.2.4 is affected.