Red Hat Directory Server/Enterprise Linux 389 Directory Server aclparse.c __aclp__normalize_acltxt aci out-of-bounds write

Summaryinfo

A vulnerability has been found in Red Hat Directory Server and Enterprise Linux and classified as critical. This affects the function __aclp__normalize_acltxt of the file aclparse.c of the component 389 Directory Server. Performing a manipulation of the argument aci results in out-of-bounds write. This vulnerability is cataloged as CVE-2026-12528. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Red Hat Directory Server and Enterprise Linux (the affected version unknown). It has been classified as critical. This affects the function __aclp__normalize_acltxt of the file aclparse.c of the component 389 Directory Server. The manipulation of the argument aci with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-12528 since 06/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/17/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Directory Service Software

Vendor

• Red Hat

Name

• Directory Server
• Enterprise Linux

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion