389 Directory Server CVE-2026-14940

The vulnerability is triggered by any LDAP operation whose DN passes through the normalization routine - most directly an LDAP Search with a crafted base DN, but potentially also Bind, Add, Modify, or Delete operations. The crafted DN must contain a legacy-quoted value encoding a multivalued nested RDN; this is a historically valid LDAP encoding, not a special server feature that must be enabled. Per CVSS PR:N, no authentication is required - the normalization occurs before credential validation. Exploitation is limited by: (1) network reachability to the LDAP port (389/636), as directory servers are typically firewalled from public internet; (2) the crash may not be reliable on every attempt given the 'may cause' language in the description; (3) impact is limited to availability - no code execution or data exfiltration is described. The flaw affects all configurations of the listed product versions with no non-default setting required to trigger it.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects moderate severity: the network vector and absence of authentication requirements make exploitation trivially accessible, but the impact is bounded to partial availability degradation. The description's qualifier 'may cause denial of service' suggests the heap corruption does not always produce a clean crash, which is consistent with A:L rather than A:H. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists, and no POC has been identified, suggesting no observed mass exploitation at time of analysis. Practically, LDAP directory servers are often internal-facing or firewalled, which reduces internet-exposed attack surface - but environments that expose LDAP/LDAPS (ports 389/636) externally face meaningful risk from unauthenticated DoS. The real-world priority is moderate: patch during routine cycles unless the directory server is externally reachable, in which case urgency increases.

An attacker with network access to the LDAP listener sends an unauthenticated LDAP SearchRequest PDU with a crafted base DN string that encodes a legacy-quoted multivalued nested RDN value. The server's DN normalization routine processes the request, triggering the out-of-bounds heap write during RDN sorting, which corrupts adjacent heap memory and may crash the 389-ds process. No public proof-of-concept code has been identified, but the attack requires no authentication and only a single crafted packet, making it trivially automatable once a working payload is developed.