Is CVE-2026-12528 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12528 being exploited in the wild.

How severe is CVE-2026-12528?

Medium severity, with a CVSS score of 5.4, published 17 June 2026.

Which products and versions are affected?

389ds 389 Directory Server 2.x; Red Hat Red Hat Directory Server 11, 12, 13; Red Hat Red Hat Enterprise Linux 7, 8, 9, 10.

Is there a fix for CVE-2026-12528?

A patch was published on 2026-06-03: Upstream pull request submitted and merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12528 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-12528?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12528: 389 Directory Server heap buffer overflow in ACI parsing

CVE-2026-12528 · Severity: medium · CVSS 5.4 · Published 2026-06-17

389 Directory Server is an enterprise-grade LDAP server used to manage user identities and access controls. A flaw in how it processes Access Control Instructions (ACIs) allows an authenticated user to corrupt the server's memory by sending a specially crafted instruction. While this could lead to minor data corruption or instability, it typically requires the attacker to already have permissions to modify security settings.

Quick answers

Is CVE-2026-12528 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12528 being exploited in the wild.
How severe is CVE-2026-12528?: Medium severity, with a CVSS score of 5.4, published 17 June 2026.
Which products and versions are affected?: 389ds 389 Directory Server 2.x; Red Hat Red Hat Directory Server 11, 12, 13; Red Hat Red Hat Enterprise Linux 7, 8, 9, 10.
Is there a fix for CVE-2026-12528?: A patch was published on 2026-06-03: Upstream pull request submitted and merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12528 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-12528?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-buffer overflow exists in the __aclp__normalize_acltxt() function within aclparse.c of 389 Directory Server. The vulnerability is caused by a failure to validate the length of an Access Control Instruction (ACI) string after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An attacker with network access and LDAP 'write' privileges to the 'aci' attribute can trigger this flaw by submitting a malformed ACI string. While the 1-byte write is not easily weaponized for code execution in production builds, it can lead to silent heap corruption or service instability. A fix has been merged into the upstream main branch.

Affected products

389ds 389 Directory Server 2.x
Red Hat Red Hat Directory Server 11, 12, 13
Red Hat Red Hat Enterprise Linux 7, 8, 9, 10

Timeline

2026-06-03: patched: Upstream pull request submitted and merged.
2026-06-17: disclosed: Vulnerability disclosed and CVE assigned.
2026-06-17: advisory: Red Hat and NVD published advisory details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.