CVE-2026-18663 in Directory Server
Summary
by MITRE • 08/12/2026
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within the 389-ds-base directory server implementation where a critical flaw in the get_ldapmessage_controls_ext() function creates a double-free condition during LDAP session handling. This issue specifically manifests when the function processes controls arrays and encounters a Session Tracking critical-control rejection scenario, where memory management becomes inconsistent. The function properly frees the parsed controls array but fails to clear the SLAPI_REQCONTROLS pblock slot reference, leaving a dangling pointer that subsequent operations will attempt to free again during normal operation teardown.
The technical exploitation requires only a single BIND request with a critical Session Tracking control, making this particularly dangerous as it represents an unauthenticated remote attack vector. The flaw resides in the memory management sequence where the same memory location gets freed twice by different code paths within the LDAP processing pipeline. This double-free condition results in heap corruption that can potentially be leveraged for more severe outcomes beyond simple denial of service, though the immediate impact is primarily heap corruption and server instability.
The operational impact extends across all systems running 389-ds-base directory servers where this vulnerability exists, affecting any environment that accepts LDAP BIND requests from untrusted sources. Organizations using this directory service for authentication, authorization, or identity management face potential service disruption and system instability when exploited. The vulnerability affects the core LDAP processing functionality and can lead to complete service unavailability, particularly in high-traffic environments where multiple concurrent connections could compound the heap corruption effects.
Security mitigations should focus on immediate patch application from the vendor to address the memory management inconsistency in the get_ldapmessage_controls_ext() function. Organizations should also implement network-level restrictions to limit exposure of LDAP services to untrusted networks and consider monitoring for unusual BIND request patterns that might indicate exploitation attempts. The vulnerability aligns with CWE-415 which addresses double free conditions in memory management, and represents a classic example of improper resource management that can lead to memory corruption. From an ATT&CK perspective, this maps to initial access through network service exploitation and privilege escalation via denial of service conditions that can disrupt critical infrastructure services.