CVE-2026-11787: 389 Directory Server Buffer Over-read in LDAP Filter Parsing

Technical summary

CVE-2026-11787 is a heap buffer over-read in 389 Directory Server's LDAP filter parsing logic. The ldap_utf8prev() function lacks proper bounds checking when reading bytes before the start of a buffer during string filter processing. This CWE-126 (Buffer Over-read) flaw allows an authenticated attacker to read memory beyond intended boundaries, potentially influencing internal filter processing behavior and exposing data resident in adjacent heap memory. The vulnerability manifests specifically in filter parsing operations triggered by LDAP protocol interaction.

Business impact

This vulnerability poses a confidentiality and integrity risk to organizations operating 389 Directory Server or Red Hat Enterprise Linux with integrated directory services. An authenticated attacker could potentially read fragments of sensitive data from server memory, including cached credentials, configuration details, or other user information. While authentication is required, compromised or low-privilege accounts could be leveraged for exploitation. Additionally, abnormal filter processing could cause operational disruptions or unexpected behavior in directory lookups, affecting authentication and authorization workflows that depend on accurate filter results.

Affected systems

Red Hat Directory Server (all versions subject to this vulnerability) and Red Hat Enterprise Linux systems that include or depend on 389 Directory Server components are affected. The vulnerability requires an authenticated connection to the LDAP service, so exposure is limited to environments where LDAP is exposed and authentication is possible. Check your current Red Hat product versions and advisory documentation to determine if your specific installations are in scope.

Exploitability

Exploitation requires LDAP authentication (PR:L in the CVSS vector), reducing opportunistic attack risk. An attacker must have valid credentials or be able to obtain them. The attack complexity is high (AC:H), meaning specific conditions or knowledge of filter structures are needed to trigger the over-read reliably. While not a trivial exploit, this is well within the capability of a malicious insider or someone with compromised low-privilege LDAP credentials. No known public exploit exists at this time, and this is not listed as a Known Exploited Vulnerability (KEV).

Remediation

Apply security updates provided by Red Hat for 389 Directory Server and Enterprise Linux. Verify the specific patch versions in Red Hat's official advisories, as version numbers vary by product line and distribution version. Additionally, restrict LDAP access to trusted internal networks and minimize the number of accounts with LDAP authentication capability. Monitor LDAP logs for unusual filter patterns or authentication attempts that may indicate exploitation attempts.

Patch guidance

Check Red Hat's official security advisories for CVE-2026-11787 to identify the correct patch versions for your installed 389 Directory Server or Enterprise Linux releases. Patching should be prioritized within a standard maintenance window given the MEDIUM severity rating and the need for authentication to exploit. Test patches in a non-production environment first, particularly to ensure filter processing behavior is not altered. If 389 Directory Server is containerized, ensure updated base images are used in your container builds.

Detection guidance

Monitor LDAP server logs for filter parsing errors or unexpected behavior in filter operations. Watch for repeated authentication attempts from specific accounts followed by complex or unusual filter strings. Heap corruption indicators in system logs or segmentation faults in slapd processes may signal exploitation attempts. Implement network segmentation to restrict LDAP traffic to known, legitimate sources, and use IDS/IPS signatures if available from Red Hat or security vendors. Enable verbose logging on LDAP filter processing if operationally feasible.

Why prioritize this

Despite the MEDIUM CVSS score, this vulnerability merits timely patching due to its confidentiality impact and the potential for insider threats. The requirement for authentication reduces but does not eliminate risk, especially in environments where account credentials are widely distributed or poorly managed. The fact that it is not yet a KEV indicates no active exploitation in the wild, providing a window to patch deliberately without emergency-driven pressure. Organizations should incorporate this into their regular patching cycles rather than delay.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects the combination of network accessibility (AV:N), required authentication (PR:L), high attack complexity (AC:H), and limited impact scope (S:U) affecting only the service itself. While confidentiality, integrity, and availability are all potentially affected (C:L/I:L/A:L), each impact is low and localized. The score appropriately weights the need for valid credentials and specific exploitation conditions against the exposure from a network-facing service.

Frequently asked questions