389 Directory Server CVE-2026-11785

Exploitation requires a valid LDAP bind with at least low-privilege credentials (confirmed by PR:L in the CVSS vector - unauthenticated access is not sufficient). The vulnerable code path is specifically the SSO token extended operation handler, meaning the SSO token extended operation feature must be reachable by the authenticated user; environments that have removed or ACL-restricted this extended operation OID are not exploitable via this path. The LDAP service must be network-reachable from the attacker (AV:N), but no special network position, man-in-the-middle, or race condition is required (AC:L). No user interaction or admin session is needed (UI:N). Exploitation is limited by: the requirement for a valid LDAP account, the partial (not full) nature of the stack address disclosure, and the absence of a demonstrated full exploit chain at time of analysis.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The network-accessible, low-complexity attack path with no user interaction is concerning, but the PR:L prerequisite (low-privilege authenticated LDAP account) is a meaningful barrier. The confidentiality impact is rated Low because only partial stack addresses are disclosed rather than sensitive directory data. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not in CISA KEV and no public proof-of-concept code is identified, making opportunistic mass exploitation unlikely in the near term. The real elevated risk is chaining: this class of stack-layout leak is a standard first stage in bypassing ASLR before triggering a memory-corruption primitive, and the 'Memory Corruption' tag hints that the underlying type confusion may be more exploitable than the current advisory conveys. CVSS Integrity and Availability scores of N/N reflect only the confirmed disclosure impact - defenders should treat this as moderate-priority, especially on Internet-exposed LDAP endpoints.

An attacker with a valid low-privilege LDAP account (or compromised service account) connects to the 389-ds LDAP endpoint over the network and sends a crafted extended operation request targeting the SSO token handler. The type confusion causes the server to serialize partial stack memory addresses into the LDAP response, which the attacker reads to map the server's memory layout. This leaked stack address data can then be fed into a separate, chained memory-corruption exploit to bypass ASLR and achieve reliable code execution. No public proof-of-concept code is known at time of analysis.