CVEvulnerability

CVE-2026-11884

6.5 MEDIUM Published 2026-06-10 Modified 2026-06-30 Official page ↗
Status
Awaiting Analysis
Published
2026-06-10
Last modified
2026-06-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-122

Description

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.

Related

Weakness · CWE (1)

  • CWE-122 Heap-based Buffer Overflow weakness

References