Executive brief
A technical flaw was identified in the 389 Directory Server, a software suite used for managing enterprise-level identity and directory services. When an administrator imports specific database files containing malformed attribute types, the system may read slightly beyond its intended memory space. While this could theoretically lead to minor information disclosure, it requires high-level administrative access and is unlikely to cause a system crash or service outage in standard production environments.
Technical details
A heap out-of-bounds read exists in the str2entry_state_information_from_type() function within entry.c of the 389 Directory Server LDIF parser. The vulnerability is triggered when the parser encounters attribute types containing trailing semicolons; specifically, the code accesses memory offsets p[3] through p[6] after a semicolon is identified via PL_strchr without verifying that sufficient bytes remain in the allocated buffer. Exploitation requires local administrator privileges to initiate an ldif2db import. While detectable under memory instrumentation (ASan), the flaw is unlikely to cause crashes in production builds due to standard heap allocator padding. All shipped versions of 389-ds-base are reportedly affected.
Affected products
- Red Hat 389 Directory Server (389-ds-base) All versions
Timeline
- 2026-06-05: disclosed: Reported via Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published advisory details