Red Hat Directory Server EUVD-2026-35424

Two distinct non-default preconditions must both be satisfied simultaneously. First, audit logging must be explicitly enabled on the 389 Directory Server instance (nsslapd-auditlog-logging-enabled: on); this is not active by default in standard deployments. Second, one of the following must also be true: (a) the password storage scheme is configured to CLEAR, which is a non-default and explicitly insecure setting that stores plaintext passwords, or (b) a replication peer in the directory topology has been compromised and can inject cleartext password operations. On top of these configuration prerequisites, exploitation requires network-accessible authentication with high privileges (PR:H per CVSS), meaning the attacker must hold directory administrator-level credentials. The CVSS AC:H further reflects that reliable heap overflow exploitation requires knowledge of heap layout. Limiting factors: standard deployments using hashed password storage (PBKDF2, SSHA512) are entirely unexposed to this code path; the vulnerability is unreachable without audit logging enabled; and exploitation does not yield code execution or confidentiality breach based on current CVSS impact scores (C:N).

The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained exploitability of this issue. The vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L indicates network-reachable attack surface but demands high attack complexity and high privileges - an attacker must already hold administrator-level access to the Directory Server instance. The scope is unchanged, meaning the overflow is contained within the directory server process, and impact is limited to low integrity (heap and audit log corruption) and low availability (potential crash or log corruption), with no confidentiality impact. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. The CVE is not in the CISA KEV catalog, and no POC is known, corroborating that this is not being actively exploited. The practical risk to most deployments is very low: organizations using default SSHA or PBKDF2 password storage are not exposed at the vulnerable code path at all. The primary risk is audit log integrity loss in edge-case configurations, which could impair forensic visibility rather than enabling direct system compromise.

An attacker who has already obtained high-privilege administrative credentials to a Red Hat Directory Server instance - for example, through credential theft or replication peer compromise - authenticates over the network, confirms that audit logging is active and CLEAR password storage is configured, then submits a short cleartext password (e.g., via a bind or password modify operation). The fixed-length mask copy in create_masked_entry_string() overflows the heap buffer, potentially corrupting adjacent heap structures or audit log entries. No public exploit identified at time of analysis, and the AC:H requirement means reliable exploitation would demand precise heap layout knowledge.