EUVD-2026-36045
GHSA-f4g5-r76v-qg3p
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
AnalysisAI
Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replication supplier to crash the server or corrupt heap memory by creating objectclass definitions with excessively long SUP (oc_superior) values. The flaw exists in schema serialization functions where the SUP field length is excluded from buffer size calculations yet still written via strcat(), producing an off-by-N heap overwrite. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to authenticate as Directory Manager (cn=Directory Manager) or hold an equivalent bind DN that has been granted ACI permissions to write to the cn=schema entry. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H accurately reflects the threat model: the vulnerability is network-reachable and requires no user interaction or special conditions beyond attacker-controlled credentials, but PR:H (high privileges - Directory Manager role) is a genuine barrier that materially limits the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained Directory Manager credentials through phishing, credential reuse, or lateral movement from a compromised RHEL host connects to the LDAP server over the network (port 389 or 636) and issues an ldapmodify or ldapadd request to add a new objectclass schema entry - for example, objectClasses: ( 1.3.6.1.4.1.99999.1 NAME 'AttackerClass' SUP [500-character string] STRUCTURAL ) - which triggers schema serialization in read_schema_dse() or schema_oc_to_string(). The strcat() call writes the long SUP string past the undersized heap buffer, overwriting adjacent heap metadata and either crashing the dirsrv process immediately (guaranteed DoS) or creating conditions for controlled heap corruption depending on memory layout. … |
| Remediation | No specific fixed package version is confirmed in the available data; monitor https://access.redhat.com/security/cve/CVE-2026-11884 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2484913 for errata publication. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic
Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack
Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat
Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confi
Share
External POC / Exploit Code
Leaving vuln.today