389 Directory Server CVE-2026-11786

Exploitation requires three simultaneous conditions: (1) local system access (AV:L) - remote network triggering is not possible per the CVSS vector; (2) high privileges (PR:H) - the attacker must hold administrative credentials sufficient to invoke LDIF database import operations, such as root or the 'cn=Directory Manager' account; (3) high attack complexity (AC:H) - the specific LDIF input must include attribute types with trailing semicolons and may require additional conditions to produce a meaningful read. The trigger is specifically the LDIF database import code path, not general LDAP query handling, meaning the vulnerability is not reachable through normal client LDAP operations. Exploitation is further limited by the read-only nature of the impact (no write or execution primitive) and the 'detectable under memory instrumentation' qualifier, which suggests unreliable behavior in hardened production deployments. RHEL's default SELinux enforcement provides additional isolation for the ns-slapd process.

The compound signal picture here is unambiguous: this is a genuinely low-risk finding. The CVSS 1.9 score (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) requires local access, high complexity, and administrator-level privileges - meaning an attacker already in a highly trusted position on the system. The sole impact is C:L (minor confidentiality loss), with no integrity or availability consequences. There is no EPSS data provided in the source intelligence, no CISA KEV listing, and no public POC. The description's qualifier - 'detectable under memory instrumentation' - further suggests the read may not produce exploitable, deterministic behavior in production; it may manifest only as a crash or silent over-read without meaningful data disclosure. SSVC signals align: exploitation status is none, automatable is no (high complexity, local vector), and technical impact is partial at best. Defenders should not treat this as an urgent remediation item unless directory server administrators are part of a specific insider threat model or the environment runs memory-sanitized builds for compliance.

A system administrator or a threat actor who has already achieved root or directory-admin privileges on a Red Hat Enterprise Linux host crafts a malformed LDIF file containing attribute type descriptors with trailing semicolons, then initiates a database import operation against the 389 Directory Server instance. The LDIF parser reads past the end of a heap buffer, potentially exposing a small amount of adjacent heap memory. No public exploit identified at time of analysis; reliable exploitation in production (without memory instrumentation) may require additional heap grooming to position sensitive data adjacent to the parser buffer.