389 Directory Server CVE-2026-11791

Exploitation requires two simultaneous conditions: (1) the attacker or insider holds administrator-level (Directory Manager) credentials sufficient to invoke a schema reload operation - this is the PR:H gating factor that prevents unauthenticated or low-privileged exploitation entirely; and (2) concurrent LDAP query traffic from other clients must be active at the moment of the schema reload, creating the race condition - this is the AC:H factor. Servers with no active query load during schema reloads (e.g., maintenance windows with traffic drained) are not vulnerable in practice. Exploitation is further limited to the schema reload code path specifically; no other administrative operations trigger attr_syntax_swap_ht(). Platforms outside the RHEL 6-10 and RHDS 11-13 ecosystem are not confirmed affected. External unauthenticated attackers cannot reach this code path without first obtaining administrative credentials.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) yields a 5.0 score that accurately reflects the constrained exploitation path. AV:N is technically correct because LDAP is a network protocol and the administrative interface is network-reachable, but PR:H means an attacker must first compromise or possess administrator-level credentials - making this effectively an insider or post-compromise threat, not a remote unauthenticated risk. AC:H captures the race condition requirement: schema reload and concurrent LDAP traffic must overlap in a specific timing window. The A:H impact (server crash) is accurate; C:N is confirmed (no information disclosure), and I:L in the provided vector is the only ambiguous signal - the description does not describe any data modification path, suggesting I:L may be a conservative allowance for potential heap corruption side effects rather than a confirmed integrity impact. No EPSS data was supplied; given the PR:H barrier and AC:H complexity, exploitation probability is expected to be very low. No KEV listing and no POC are reported, reinforcing that this is a low-urgency issue for most environments. The primary risk scenario is an insider or already-compromised admin deliberately triggering crashes, or accidental DoS during routine maintenance windows.

A threat actor who has obtained Directory Manager credentials - either through credential theft, insider access, or a prior compromise - authenticates to the 389 Directory Server and issues a schema reload operation (e.g., via ldapmodify targeting cn=schema) while the server is under normal LDAP query load from applications. The race between attr_syntax_swap_ht() freeing syntax nodes and concurrent worker threads dereferencing those same nodes causes a use-after-free, crashing the directory server process and interrupting all LDAP-dependent services (authentication, authorization, application logins). No public proof-of-concept code has been identified at time of analysis.