389 Directory Server EUVD-2026-35421

Exploitation requires a network-accessible 389 Directory Server instance with the SMD5 password storage plugin active (this plugin must be loaded and in use for stored password verification). The CVSS vector PR:H confirms that the attacker must hold high-level directory privileges - specifically the ability to submit a bind request that is processed by the SMD5 plugin, which implies either admin credentials or an account whose stored hash the server will attempt to verify using SMD5. The trigger condition is a stored or submitted hash value shorter than 16 bytes. Exploitation is limited by: (1) requirement for high-privilege authentication before the vulnerable code path is reached; (2) SMD5 plugin must be enabled - environments using only modern hash schemes (PBKDF2, bcrypt, SHA-2) are not exposed via this specific path; (3) the attacker must be able to reach the LDAP service port over the network.

The CVSS base score of 4.9 is consistent with the PR:H constraint in the vector - an attacker must hold high-privilege credentials (e.g., Directory Manager or equivalent) before triggering the crash, which substantially narrows the realistic attacker population. The AV:N and AC:L components indicate that, once authenticated, exploitation is straightforward over the network with no additional complexity. The availability impact is rated High (A:H), meaning a successful exploit terminates the LDAP service entirely, which could cascade into authentication outages across dependent systems. No EPSS score was provided, preventing quantitative comparison against base-rate exploitation probability. KEV status is negative and no POC has been identified, suggesting no known in-the-wild activity at time of analysis. The net risk posture: moderate priority for environments where directory service availability is critical and where privileged accounts are not tightly controlled, but lower urgency than a PR:N exploit of equivalent CVSS score. One conflicting signal: the NVD tags list 'Integer Overflow' while CWE-191 describes an Integer Underflow - the description text confirms underflow; the tag appears to be a mislabeling.

An attacker who has obtained high-privilege LDAP credentials - for example, through credential theft, a misconfigured service account, or insider access - sends a specially crafted LDAP bind request containing an SMD5-formatted password hash that is fewer than 16 bytes in length. The SMD5 plugin's salt-length computation wraps around to a very large unsigned value, causing the server to read far beyond the valid buffer and crash. This immediately denies LDAP authentication service to all users and integrated systems until the server is manually restarted.