Vulnerability · Published Jun 17, 2026 · Assigned by redhat
CVE-2026-12528389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()
Medium 5.4
In plain English
A medium-severity out-of-bounds write in Red Hat Directory Server 11 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | 389-ds-base | no fix listed | DEBIAN-CVE-2026-12528 |
| Debian:13 | 389-ds-base | no fix listed | DEBIAN-CVE-2026-12528 |
| Ubuntu:22.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-12528 |
| Ubuntu:24.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-12528 |
| Ubuntu:25.10 | 389-ds-base | no fix listed | UBUNTU-CVE-2026-12528 |
| Ubuntu:26.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-12528 |
| Ubuntu:26.10 | 389-ds-base | no fix listed | UBUNTU-CVE-2026-12528 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Directory Server 11 | see references |
| Red Hat | Red Hat Directory Server 12 | see references |
| Red Hat | Red Hat Directory Server 13 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-12528 vdb-entry, x_refsource_REDHAT
- RHBZ#2489835 issue-tracking, x_refsource_REDHAT
- https://github.com/389ds/389-ds-base/pull/7542