# CVE-2025-14905: Red Hat 389-ds-base heap buffer overflow in schema_attr_enum_callback

Source: https://junglewise.ai/threats/cve-2025-14905-red-hat-389-ds-base-heap-buffer-overflow-in-schema-attr-enum  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-23. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-14905 · Severity: high · CVSS 7.2 · Published 2026-02-23

A security vulnerability has been identified in the 389 Directory Server, an enterprise-grade tool used to manage user identities and access across a network. An attacker with high-level administrative privileges could exploit this flaw to crash the server or potentially execute malicious code. This could lead to a total service outage or unauthorized access to sensitive directory data.

Technologies: [Red Hat 389-Ds-Base](https://junglewise.ai/threats/technologies/389-ds-base). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-14905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14905 being exploited in the wild.

**How severe is CVE-2025-14905?** High severity, with a CVSS score of 7.2, published 23 February 2026.

**Which products and versions are affected?** Red Hat 389-Ds-Base 3.1.3-7.el10_1, 2.7.0-10.el9_7.

**Is there a fix for CVE-2025-14905?** A patch was published on 2026-02-24: Red Hat released security advisories and updated packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14905 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-14905?** Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the schema_attr_enum_callback function within schema.c of the 389-ds-base server. The vulnerability is caused by an incorrect buffer size calculation that sums alias string lengths without accounting for necessary formatting characters. A remote attacker with high privileges (PR:H) can trigger this overflow by processing a large number of aliases. Successful exploitation could result in a crash of the LDAP service or arbitrary code execution. Red Hat has released security updates (e.g., RHSA-2026:3189, RHSA-2026:3208) to address this issue across various versions of RHEL and Directory Server.

## Affected products

- Red Hat 389-ds-base 3.1.3-7.el10_1, 2.7.0-10.el9_7
- Red Hat Red Hat Directory Server 11.5, 11.7, 11.9, 12.2, 12.4
- Red Hat Red Hat Enterprise Linux 8, 9, 10

## Timeline

- 2025-02-23: disclosed: CVE published date
- 2026-02-24: patched: Red Hat released security advisories and updated packages

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHSA-2026:3189](https://access.redhat.com/errata/RHSA-2026:3189)
- [https://access.redhat.com/errata/RHSA-2026:3208](https://access.redhat.com/errata/RHSA-2026:3208)
- [https://access.redhat.com/errata/RHSA-2026:3379](https://access.redhat.com/errata/RHSA-2026:3379)
- [https://access.redhat.com/errata/RHSA-2026:3504](https://access.redhat.com/errata/RHSA-2026:3504)
- [https://access.redhat.com/errata/RHSA-2026:4207](https://access.redhat.com/errata/RHSA-2026:4207)

## Related threats

- [389-ds-base NULL pointer dereference in ModifyDN](https://junglewise.ai/threats/cve-2026-117548-a-null-pointer-dereference-flaw-was-found-in-389-ds-base-this)
- [389-ds-base StartTLS plaintext buffer injection](https://junglewise.ai/threats/cve-2026-86345-a-flaw-was-found-in-389-ds-base-the-server-does-not-discard)
- [Red Hat 389-ds-base heap buffer overflow in rdn_av_swap](https://junglewise.ai/threats/cve-2026-16560-red-hat-389-ds-base-heap-buffer-overflow-in-rdn-av-swap)
- [Red Hat 389-ds-base Predictable IV in LDBM Attribute Encryption](https://junglewise.ai/threats/cve-2026-14969-red-hat-389-ds-base-predictable-iv-in-ldbm-attribute-encryption)
- [Red Hat 389-ds-base heap buffer overflow in sasl_io_recv](https://junglewise.ai/threats/cve-2026-11610-red-hat-389-ds-base-heap-buffer-overflow-in-sasl-io-recv)