Log in Start free

Vulnerability · Published Jul 3, 2026 · Assigned by redhat

CVE-2026-14612Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization

Medium 4.2

In plain English

A medium-severity out-of-bounds write in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12freeipano fix listedDEBIAN-CVE-2026-14612
Debian:13freeipano fix listedDEBIAN-CVE-2026-14612
Ubuntu:22.04:LTSfreeipano fix listedUBUNTU-CVE-2026-14612
Ubuntu:24.04:LTSfreeipano fix listedUBUNTU-CVE-2026-14612
Ubuntu:25.10freeipano fix listedUBUNTU-CVE-2026-14612
Ubuntu:26.04:LTSfreeipano fix listedUBUNTU-CVE-2026-14612
Ubuntu:26.10freeipano fix listedUBUNTU-CVE-2026-14612

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

References