389 Directory Server CVE-2026-12528

Exploitation requires an active, authenticated LDAP session where the account holds explicit write access to the aci attribute on at least one directory entry - this is a privileged delegation that is not granted to standard directory users by default and must be configured by a directory administrator. The attacker must be able to issue an LDAP modify (ldapmodify) operation that sets the aci attribute to a string whose keyword portion is 0-2 characters after internal whitespace stripping. Standard read-only LDAP users, anonymous binds, and users without aci-write delegation cannot trigger this vulnerability. Reliable exploitation for code execution is further constrained by the need for heap grooming beyond the initial 1-byte out-of-bounds write, as the corruption is described as silent rather than immediately deterministic.

The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the threat model: the network attack vector lowers the physical barrier to exploitation, but PR:L confirms that a valid authenticated session with aci-write delegation is required - a non-trivial prerequisite. The absence of confidentiality impact (C:N) aligns with the description's characterization of silent heap corruption rather than direct data disclosure. The limited I:L and A:L scores are consistent with the realistic outcome: heap corruption may cause server instability or subtle data integrity issues but reliable escalation to remote code execution would require additional exploit sophistication not evidenced in available data. No EPSS score was provided, and neither KEV listing nor public POC exploit has been identified, suggesting this vulnerability has not been broadly weaponized. The primary risk is insider threat or a compromised account with directory write privileges, rather than opportunistic network-wide scanning. The real-world priority is moderate: patch when available and restrict aci-write delegation in the interim.

An authenticated LDAP user who has been delegated write access to the aci attribute on a directory suffix crafts a malformed ACI string in which the keyword segment is reduced to one or two characters after whitespace normalization, then submits it via an ldapmodify operation. The server's __aclp__normalize_acltxt() function processes the value without length validation, writing one byte past the end of the keyword buffer and reading adjacent heap memory, silently corrupting server heap state. No public proof-of-concept exploit has been identified, but the code-level detail in PR #7542 is sufficient to reconstruct the trigger condition for a motivated researcher.