Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain Kerberos ticket or LDAP credential
  2. Delivery
    Connect to ns-slapd LDAP port
  3. Exploit
    Complete SASL bind with SSF>0
  4. Install
    Send packet with length prefix 0xFFFFFFFC
  5. C2
    Trigger integer overflow in sasl_io_start_packet
  6. Execute
    Corrupt ns-slapd heap with ~2MB payload
  7. Impact
    Crash service or execute code as directory account

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must (1) reach a directory server's LDAP/LDAPS port over the network, (2) complete a successful SASL bind that negotiates a security layer with SSF > 0 (integrity or confidentiality, typically GSSAPI/Kerberos or DIGEST-MD5), and (3) send a crafted SASL packet whose 32-bit length prefix is 0xFFFFFFFC to trigger the wraparound in sasl_io_start_packet. The PR:L requirement is sharply lowered in FreeIPA and Red Hat Identity Management deployments because any domain user with a valid Kerberos ticket, any enrolled host's keytab, or any service principal satisfies the SASL-bind prerequisite - so in IdM realms this is effectively any authenticated identity. Limiting factors: a plain anonymous or simple-bind LDAP exposure without SASL+SSF is not exploitable through this path, and standalone directory servers that only permit simple binds or SASL EXTERNAL without an integrity layer would not reach the vulnerable code.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H combined with confirmed RCE potential and a high-value target (the directory service that backs Kerberos/LDAP authentication) makes this a genuine priority for any environment running 389-ds, RHDS, FreeIPA, or RH IdM. PR:L is the key gating factor - exploitation requires a successful SASL bind with SSF > 0, so this is not a fully unauthenticated internet flaw, but in IdM/FreeIPA realms the bar is dramatically lower because any domain user, enrolled host keytab, or service principal already holds a Kerberos ticket that satisfies the prerequisite. Neither EPSS nor CISA KEV data was supplied in the input, and no public PoC is referenced; absence of a KEV listing should not be read as low risk given how easy authenticated access is in Kerberos-integrated deployments. The C:L/I:L scoring is conservative for a heap overflow that the description explicitly states can yield RCE - defenders should treat the worst-case (process compromise of the ns-slapd service running with directory privileges) as plausible rather than relying solely on the partial-impact CVSS sub-scores.
Exploit ScenarioDerived

An attacker with any valid Kerberos credential in a FreeIPA/IdM realm - for example a low-privileged domain user, a stolen host keytab, or a compromised service account - opens an LDAP connection to a directory replica, completes a GSSAPI SASL bind negotiating integrity protection, then sends a SASL-framed message whose 4-byte length prefix is 0xFFFFFFFC. The integer overflow in sasl_io_start_packet allocates a near-zero buffer that is then filled with roughly 2 MB of attacker-controlled bytes, corrupting the ns-slapd heap to either crash the directory (denial of service that takes down authentication for the whole realm) or, with appropriate heap grooming, achieve remote code execution as the directory service account.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 11, 2026

Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash the LDAP service or achieve remote code execution after a successful SASL bind with integrity protection (SSF > 0). The flaw stems from an integer overflow in sasl_io_start_packet() that bypasses the nsslapd-maxsasliosize ceiling, enabling roughly 2 MB of attacker-controlled heap corruption. No public exploit identified at time of analysis, and the impact is amplified in FreeIPA and Red Hat Identity Management deployments where any enrolled user, host, or service principal qualifies as an authenticated attacker.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references; monitor https://access.redhat.com/security/cve/CVE-2026-11774 and the linked Bugzilla 2484916 for fixed package versions (389-ds-base for RHEL 8/9/10 and redhat-ds for RHDS 11/12/13) and apply them as soon as they ship, prioritizing IdM/FreeIPA replicas. Until a patch is available, the most direct compensating control is to restrict SASL bind exposure - lower nsslapd-maxsasliosize toward the smallest value compatible with your largest legitimate SASL message (note this only narrows, not eliminates, the overflow window because the overflow bypasses the check entirely) and front the LDAP/LDAPS ports (389/636/3268/3269) with host firewall rules that allow only trusted client subnets and replication peers, accepting that IdM clients still need access. Where feasible, disable SASL mechanisms that negotiate integrity or confidentiality (SSF > 0) on edge replicas, but be aware this breaks GSSAPI/Kerberos binds and will disrupt FreeIPA enrollment, kinit-based logins, and replication, so it is realistic only for read-only consumer instances. Increase monitoring of ns-slapd for unexpected crashes or restarts and audit Kerberos principal issuance to limit the population of attackers who can complete a SASL bind.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is the upstream LDAP implementation behind Red Hat Directory Server and the identity backbone of FreeIPA / Red Hat Identity Management. The bug lives in the SASL framing code (sasl_io.c, function sasl_io_start_packet) that reads the 4-byte length prefix preceding each SASL-wrapped LDAP message. The implementation adds sizeof(uint32_t) (4) to the attacker-supplied length to allocate a receive buffer; a crafted prefix of 0xFFFFFFFC wraps the unsigned 32-bit addition to 0, defeating the nsslapd-maxsasliosize sanity check and causing a vastly undersized allocation that is then filled with up to ~2 MB of attacker bytes - a textbook CWE-190 integer overflow leading to a heap buffer overflow. The advisory explicitly notes this is a distinct code path from CVE-2025-14905, which only repaired schema.c and left sasl_io.c untouched. CPE data covers Red Hat Directory Server 11/12/13 and the 389-ds-base packages shipped in RHEL 6 through 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.6 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
vuln.today AI 7.6 HIGH

Network-reachable LDAP (AV:N), deterministic overflow trigger (AC:L), requires a successful SASL bind so PR:L; RCE potential gives some C/I impact but reliable outcome is service crash, hence A:H with C:L/I:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.6 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

DescriptionCVE.org

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.

Executive ViewAI

Why It Matters

A vulnerability in 389 Directory Server permits authenticated users to execute arbitrary code or crash the LDAP service, directly compromising directory availability and identity management in FreeIPA and Red Hat Identity Management environments. Any enrolled user, host, or service principal can trigger the flaw post-authentication, creating broad attack surface within core authentication infrastructure.

Business Impact: High
Compensating Controls

Restrict LDAP service network exposure to internal trusted networks; implement mandatory audit logging and alerting on SASL bind failures and service crashes; enforce strict controls on directory enrollment to limit authenticated attacker population; maintain frequent encrypted backups of directory state; deploy network-based intrusion detection tuned for abnormal LDAP traffic patterns.

Threat Intelligence Overview

EPSS Score
0.1%
Top 77% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11774 ADVISORY https://vuldb.com/vuln/370411 REF https://access.redhat.com/errata/RHSA-2026:36195 REF https://access.redhat.com/errata/RHSA-2026:36196 REF https://access.redhat.com/errata/RHSA-2026:36197 REF https://access.redhat.com/errata/RHSA-2026:36198 REF https://access.redhat.com/errata/RHSA-2026:36200 REF https://access.redhat.com/errata/RHSA-2026:36201 REF https://access.redhat.com/errata/RHSA-2026:36202 REF https://access.redhat.com/errata/RHSA-2026:36204 REF https://access.redhat.com/errata/RHSA-2026:36205 REF https://access.redhat.com/errata/RHSA-2026:36206 REF https://access.redhat.com/errata/RHSA-2026:36208 REF https://access.redhat.com/errata/RHSA-2026:36209 REF https://access.redhat.com/errata/RHSA-2026:36585 REF https://access.redhat.com/errata/RHSA-2026:36641 REF https://access.redhat.com/errata/RHSA-2026:36660 REF https://access.redhat.com/errata/RHSA-2026:36670 REF https://access.redhat.com/errata/RHSA-2026:36671 REF https://access.redhat.com/security/cve/CVE-2026-11774 REF https://bugzilla.redhat.com/show_bug.cgi?id=2484916 REF https://redhat.atlassian.net/browse/PSIRTSUPT-7600 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11774.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy