CVE-2026-12528: fallo de gravedad media en Red Hat Directory Server 11
389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
probabilidad de explotación
0.2%top 88% de las CVE
explotación observada
noninguna fuente lo reporta
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Red Hat · Red Hat Directory Server 11Red Hat · Red Hat Directory Server 12Red Hat · Red Hat Directory Server 13Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9CVEs relacionadas — Red Hat Directory Server 11
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-14905HIGH389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflowEPSS 1.2%CVE-2026-9064HIGH389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)EPSS 1.1%CVE-2024-6237MEDIUM389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search requestEPSS 0.9%CVE-2026-18453HIGH389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchEPSS 0.8%CVE-2026-18355HIGH389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()EPSS 0.8%CVE-2026-15722HIGH389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsingEPSS 0.8%