CVE-2026-11774: 389 Directory Server SASL Integer Overflow Remote Code Execution

Technical summary

The vulnerability exists in the sasl_io_start_packet() function within 389-ds-base's SASL I/O layer. When processing a SASL packet with a crafted length prefix of 0xFFFFFFFC, the addition of sizeof(uint32_t) causes unsigned integer wraparound to zero. This bypass circumvents the nsslapd-maxsasliosize limit check, allowing subsequent allocation and write operations to proceed without the intended bounds protection. The overflow occurs during or after SASL bind completion when integrity protection is active (SSF > 0). This is a distinct flaw from CVE-2025-14905, which addressed schema validation separately and did not remediate this sasl_io.c code path.

Business impact

Directory services are critical for authentication and identity management across enterprise networks. Compromise of 389 Directory Server can lead to service unavailability affecting all dependent applications, or worse, unauthorized code execution with directory server privileges. In FreeIPA and Red Hat Identity Management contexts, any domain user becomes a potential attack vector, significantly expanding the threat surface. Organizations relying on these systems for Kerberos-based authentication face both availability and confidentiality/integrity risks.

Affected systems

389 Directory Server (389-ds-base) is affected. The vulnerability is particularly acute in FreeIPA and Red Hat Identity Management deployments where the authentication model allows domain users, enrolled hosts, and service accounts to initiate SASL binds. Any environment using SASL with integrity protection (SSF > 0) is vulnerable. Verify the specific version running in your environment against the vendor's security advisory for precise patch applicability.

Exploitability

Exploitability is moderate-to-high in federated identity environments. An attacker must first obtain valid credentials (Kerberos ticket, service account, or domain user status), but in FreeIPA deployments this is a low bar since any domain user qualifies. No user interaction is required, and the attack is triggered over the network with a single malformed packet after authentication. The simplicity of the integer overflow condition and the broad credential eligibility make this relatively easy to weaponize once access is present.

Remediation

Apply the security patch released by Red Hat or 389 Directory Server maintainers for this vulnerability. The patch addresses the sasl_io.c code path to properly validate packet lengths before arithmetic operations. Organizations should prioritize patching directory servers, then verify that integrity protection settings (SSF configuration) are appropriate for their security posture. No workarounds are available; patching is the only mitigation.

Patch guidance

Check the Red Hat Security Advisory and 389 Directory Server release notes for the corrected version. Install the patched 389-ds-base package and restart the directory service. In high-availability deployments, apply patches in rolling fashion to maintain service continuity. Test the patch in a non-production environment first, particularly if custom SASL configurations are in use. Verify that SASL authentication continues to function correctly post-patch.

Detection guidance

Monitor directory server logs for unusual packet structures or size errors in SASL I/O processing. Intrusion detection systems may flag packets with suspiciously large SASL payloads or repeated connection attempts with crafted authentication data. Track authentication events for domain users or service accounts originating from unexpected network locations. Heap corruption or segmentation faults in the directory server process can indicate exploitation attempts; monitor process stability and core dumps.

Why prioritize this

This vulnerability merits urgent attention due to the combination of: (1) unauthenticated-seeming ease of exploitation by any domain user; (2) potential for remote code execution in addition to denial of service; (3) criticality of directory services to enterprise authentication infrastructure; (4) broad applicability in FreeIPA and Red Hat Identity Management deployments. The CVSS score of 7.6 (HIGH) appropriately reflects the risk.

Risk score, explained

CVSS 3.1 score of 7.6 reflects a high-severity flaw with network accessibility (AV:N), low attack complexity (AC:L), and requirement for low-level privileges (PR:L—any domain user suffices). The impact is substantial: loss of availability (heap overflow causing DoS), partial confidentiality and integrity impact (RCE potential). The score does not require active exploitation in the wild but accounts for the realistic threat in identity-managed environments.

Frequently asked questions