389 Directory Server CVE-2026-11793

Exploitation requires the attacker to be authenticated as Directory Manager (the highest-privilege LDAP role), confirmed by CVSS PR:H. The vulnerable code path is reached only when the server processes a reversible-encrypted attribute value - meaning the directory must have at least one attribute configured for reversible encryption (a non-default setting). No user interaction is required (UI:N) and attack complexity is low (AC:L) once these prerequisites are satisfied. What limits exploitation: (1) Directory Manager credential is required - a highly privileged account that should be tightly controlled; (2) reversible password encryption must be configured and in use; (3) FORTIFY_SOURCE prevents the overflow from becoming arbitrary code execution, capping impact at service crash. The combination of PR:H and a non-default encryption configuration makes opportunistic mass exploitation highly unlikely.

The CVSS 4.9 (Medium) score is consistent with the actual risk profile: AV:N confirms network reachability, AC:L reflects low exploit complexity once prerequisites are met, but PR:H (Directory Manager privileges required) is the primary limiting factor that depresses the score and real-world risk. Directory Manager is the highest-privilege role in 389-ds, analogous to a root DBA - an attacker who already holds this credential has full directory control and would rarely need to resort to crashing the server. The realistic threat actor is a malicious insider or a post-compromise attacker seeking to disrupt authentication services. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis. FORTIFY_SOURCE as a mitigating control is confirmed by the CVE description itself, which explicitly states it 'mitigates this to denial of service only' - this is a notable cross-signal: the raw CWE-121 classification implies potential RCE severity, but the compile-time hardening effectively caps impact. Defenders should treat this as a moderate-priority patch rather than an emergency.

An attacker who has obtained Directory Manager credentials - through credential theft, insider access, or prior compromise - connects to the LDAP server over the network and issues an LDAP modify operation that stores a crafted attribute value containing a reversible-encrypted password with an algorithm ID exceeding 256 bytes. When 389-ds subsequently calls checkPrefix() to parse the stored value, the oversized algorithm ID overflows the stack buffer, FORTIFY_SOURCE detects the corruption, and the server process is aborted - taking down LDAP authentication for all dependent systems until the service is manually restarted.