389 Directory Server CVE-2026-11884

Exploitation requires the attacker to authenticate as Directory Manager (cn=Directory Manager) or hold an equivalent bind DN that has been granted ACI permissions to write to the cn=schema entry. Alternatively, a compromised replication supplier in the directory's replication topology can inject malformed schema updates without a separate credential requirement on the consumer. The vulnerability fires specifically during objectclass creation or modification requests that include a long SUP (superior class) value, which invokes the flawed schema serialization code path in read_schema_dse() or schema_oc_to_string(). Exploitation is explicitly bounded by: (1) the PR:H CVSS requirement - standard LDAP user binds, even with write access to the DIT, cannot modify cn=schema without Directory Manager or schema-admin-equivalent privilege; and (2) the specific schema modification operation - passive read operations, authentication events, and normal DIT writes do not traverse the vulnerable code path. Non-default configurations are not required; the flaw exists in default installations of affected versions whenever the schema management interface is reachable.

CVSS 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H accurately reflects the threat model: the vulnerability is network-reachable and requires no user interaction or special conditions beyond attacker-controlled credentials, but PR:H (high privileges - Directory Manager role) is a genuine barrier that materially limits the attack surface. The integrity and availability impact without confidentiality loss is consistent with a heap overflow that can corrupt server data structures or terminate the process outright. The incomplete-fix designation is an important risk amplifier: organizations that specifically patched CVE-2025-14905 and considered themselves remediated may still be fully vulnerable to this variant, warranting re-validation of patch scope. EPSS data was not provided in the available intelligence; no CISA KEV listing is present and no public exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. The primary realistic risk vector is insider threat or lateral movement from a compromised privileged account, not external unauthenticated attack. SSVC assessment: exploitation status is none/proof-of-concept-class (well-defined trigger but no known weaponized code); technically impactful (server DoS and potential heap corruption); not broadly automatable due to PR:H requirement.

An attacker who has obtained Directory Manager credentials through phishing, credential reuse, or lateral movement from a compromised RHEL host connects to the LDAP server over the network (port 389 or 636) and issues an ldapmodify or ldapadd request to add a new objectclass schema entry - for example, objectClasses: ( 1.3.6.1.4.1.99999.1 NAME 'AttackerClass' SUP [500-character string] STRUCTURAL ) - which triggers schema serialization in read_schema_dse() or schema_oc_to_string(). The strcat() call writes the long SUP string past the undersized heap buffer, overwriting adjacent heap metadata and either crashing the dirsrv process immediately (guaranteed DoS) or creating conditions for controlled heap corruption depending on memory layout. No public exploit code has been identified, but the trigger condition is precise and well-documented, lowering the barrier for capable researchers to develop proof-of-concept code.