Executive brief
389 Directory Server, a professional-grade LDAP server used for enterprise identity management, is vulnerable to a memory corruption flaw. An attacker with administrative privileges or a compromised server in a replication network can cause the directory service to crash. This disrupts authentication and identity services across the organization, though it is unlikely to lead to data theft on modern systems.
Technical details
A heap buffer overflow exists in the schema serialization code of 389 Directory Server, specifically within the read_schema_dse() and schema_oc_to_string() functions. The vulnerability occurs because the length of the oc_superior (SUP) field is omitted from buffer size calculations, yet the field is subsequently written to the buffer using strcat(). An attacker with Directory Manager privileges can trigger a crash during schema reads (if SUP >= ~248 bytes) or during replication comparisons (if SUP >= ~62 bytes). While this is a heap overflow, remote code execution (RCE) is deemed unlikely on x86_64 architectures due to the ASCII-only nature of the overflow content. This is an incomplete fix variant of CVE-2025-14905.
Affected products
- Red Hat 389 Directory Server All versions prior to fix
Timeline
- 2025-12-18: disclosed: Initial parent vulnerability CVE-2025-14905 reported
- 2026-06-04: disclosed: Variant CVE-2026-11884 reported to Red Hat
- 2026-06-10: advisory: NVD publication of CVE-2026-11884