CVE-2026-11792: 389 Directory Server Heap Buffer Overflow in Audit Logging

Technical summary

CVE-2026-11792 is a heap buffer overflow in the create_masked_entry_string() function within auditlog.c. The function copies a fixed-length password mask into a heap buffer without verifying sufficient space remains. The overflow occurs only when audit logging is active and a short cleartext password is logged—a condition that requires either non-default CLEAR password storage policy or password data arriving from a compromised replication peer. The flaw corrupts heap metadata and produces malformed audit log entries.

Business impact

The business impact is limited by the exploitation constraints. An organization running 389 Directory Server with audit logging would experience audit log corruption, potentially obscuring compliance records and incident investigation trails. No confidentiality breach occurs. Availability impact is also low unless heap corruption triggers a crash, which is not guaranteed. Organizations relying on audit logs for security monitoring or regulatory compliance should address this, but the threat does not represent immediate operational risk.

Affected systems

The vulnerability affects 389 Directory Server installations with audit logging enabled. The specific conditions—short cleartext passwords and non-default storage policies—are uncommon in typical deployments. Replication scenarios involving a compromised peer represent an additional attack surface. Organizations should verify their password storage settings and audit logging configuration to determine exposure.

Exploitability

Exploitability is constrained by multiple prerequisites. An attacker must either compromise a replication peer to inject malicious password data, or the target must be running a non-standard configuration that stores cleartext passwords. Neither condition is typical. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) reflects high attack complexity and required high privileges. No public exploit code is known, and active exploitation in the wild is unlikely.

Remediation

Apply the security patch released by Red Hat for 389 Directory Server. Verify the patch version against the vendor advisory. In the interim, review password storage policies to ensure CLEAR storage is not enabled unless operationally necessary. Audit logging can be temporarily disabled if compliance requirements permit, though this reduces detective capabilities. Segregate replication connections and monitor for unauthorized replication attempts.

Patch guidance

Check the Red Hat Security Advisory for 389 Directory Server CVE-2026-11792 for the specific patched version applicable to your release branch. Deploy patches in your change management process with priority appropriate for a LOW-severity flaw with limited real-world exploitation potential. Verify audit logging functionality after patching to confirm no regression.

Detection guidance

Monitor 389 Directory Server audit logs for malformed or truncated entries, particularly those involving password operations. Alert on unexpected heap corruption indicators if available through your monitoring tools. Review replication peer configurations and restrict replication to trusted, hardened systems. Check system logs for unexpected crashes or segmentation faults in the Directory Server process, which could indicate heap memory corruption.

Why prioritize this

This is a low-priority patch driven by the combination of low CVSS score (3.3), multiple exploitation prerequisites, and low real-world attack likelihood. It does not appear on the CISA KEV catalog. Prioritize patches for critical and high-severity vulnerabilities first; schedule this for routine maintenance windows. However, organizations with strict compliance audit requirements should move it forward in their queue because audit log integrity has secondary compliance value.

Risk score, explained

CVSS 3.3 (LOW) reflects: minimal confidentiality impact, low integrity impact limited to audit logs, minimal availability impact, network accessibility, but very high attack complexity (AC:H) due to password storage and replication preconditions, and requirement for high privileges (PR:H). The flaw is real and should be patched, but real-world risk is substantially lower than the CVSS alone suggests because the prerequisites are uncommon.

Frequently asked questions