Skip to content
fr Sign in
5.4 Medium

CVE-2026-12528 A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c

Description

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.

Affected products and versions

Product Affected versions Fixed in
Red Hat Directory Server 11 Versions not published
Red Hat Directory Server 12 Versions not published
Red Hat Directory Server 13 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Directory Server 11

The 42 CVEs of Red Hat Directory Server 11 →
CVE-2026-117548 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service 6.5 Medium CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result 9.0 Critical CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue 7.5 High CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor 8.4 High
Track this CVE