389 Directory Server CVE-2026-11787

Exploitation requires an authenticated LDAP session - the CVSS vector PR:L confirms low-privilege credentials are sufficient; anonymous binds alone are not enough. The attack vector is Network (AV:N), meaning the attacker must be able to reach the LDAP service port (389/636) over the network, but physical or local access is not required. High Attack Complexity (AC:H) is the most significant limiting factor: the attacker must craft input that reliably positions ldap_utf8prev() at the precise start of a heap buffer, which depends on internal heap state and UTF-8 string layout - this is not trivially reproducible across arbitrary server states. The flaw is triggered specifically through LDAP Search Request filter strings containing UTF-8 character sequences processed by the string filter parser; deployments that do not expose LDAP search to untrusted authenticated users are at reduced risk. No special non-default configuration is indicated as required beyond having the Directory Server running and accessible.

The overall risk is moderate and context-dependent. CVSS 3.1 scores this at 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), which correctly captures that network reachability is possible but exploitation requires both an authenticated session (PR:L) and high attack complexity (AC:H) - meaning specific, non-trivial conditions must be met regarding input crafting or server state. All three impact dimensions are rated Low, indicating blast radius is constrained; scope is Unchanged, so lateral movement via this vulnerability alone is unlikely. No EPSS score was provided in the intelligence data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, further depressing near-term exploitation probability. The primary concern is heap layout disclosure through the over-read influencing filter behavior - an attacker with LDAP bind credentials could potentially extract partial heap memory or manipulate search results in subtle ways. For organizations with externally exposed LDAP endpoints or shared multi-tenant directories, the AC:H requirement may be achievable with targeted effort, making this a higher priority in those deployments despite the moderate base score.

An attacker with valid LDAP credentials - such as a low-privileged service account or an internal user in a corporate directory - crafts an LDAP Search Request containing a string filter with a malformed or edge-case UTF-8 sequence designed to position the ldap_utf8prev() pointer at the very start of the heap buffer, causing a backward read beyond the buffer boundary. The over-read bytes influence the filter parsing result, potentially leaking partial heap memory content into filter evaluation logic or producing unexpected search behavior, which the attacker could use to probe directory structure or infer heap layout for further exploitation. No public proof-of-concept has been identified, and AC:H indicates that reliably triggering this condition requires non-trivial input construction.