Red Hat Directory Server/Enterprise Linux 389 Directory Server schema.c sasl_io_start_packet integer overflow

Summaryinfo

A vulnerability classified as very critical has been found in Red Hat Directory Server and Enterprise Linux. This affects the function sasl_io_start_packet of the file schema.c of the component 389 Directory Server. This manipulation causes integer overflow. This vulnerability is handled as CVE-2026-11774. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Red Hat Directory Server and Enterprise Linux (version now known). It has been declared as very critical. Affected by this vulnerability is the function sasl_io_start_packet of the file schema.c of the component 389 Directory Server. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify sasl_io.c.

It is possible to read the advisory at access.redhat.com. This vulnerability is known as CVE-2026-11774 since 06/09/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/12/2026).

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36293). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Directory Service Software

Vendor

• Red Hat

Name

• Directory Server
• Enterprise Linux

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion