CVE-2026-12528: 389 Directory Server Heap Buffer Overflow in ACI Parsing

Technical summary

CVE-2026-12528 is a heap-buffer-overflow vulnerability in the __aclp__normalize_acltxt() function within 389 Directory Server's aclparse.c. The vulnerability stems from insufficient length validation of ACI keywords after whitespace stripping. A crafted ACI string can trigger a 1-byte out-of-bounds write followed by out-of-bounds reads, allowing silent heap corruption. The attack vector is network-based with low complexity; the attacker must be authenticated and possess write access to the aci attribute. The vulnerability is classified as CWE-787 (Out-of-bounds Write).

Business impact

This vulnerability affects the integrity and availability of Directory Server deployments. An authenticated insider or compromised account with aci write privileges could silently corrupt heap memory, leading to unpredictable service behavior, potential data inconsistency, or eventual denial of service. Organizations relying on 389 Directory Server for LDAP-based identity management should assess their access control policies and patch urgency based on the sensitivity of aci attribute write permissions within their environment.

Affected systems

Red Hat 389 Directory Server and Red Hat Enterprise Linux distributions that include Directory Server are affected. The vulnerability requires authentication and explicit write access to the aci attribute, limiting the immediate risk to internal users, applications, or administrators with that privilege level. Organizations should inventory instances of 389 Directory Server and evaluate who holds aci write permissions.

Exploitability

Exploitation requires authentication to the Directory Server and write access to the aci attribute—not a trivial barrier, but one that may be held by multiple internal users or service accounts. No exploit code is publicly available. The low attack complexity and straightforward mechanics (sending a malformed ACI string) mean that once an attacker gains the required privileges, the vulnerability is straightforward to trigger. The lack of KEV designation suggests this has not yet been observed in active exploitation campaigns.

Remediation

Apply security updates provided by Red Hat for 389 Directory Server and affected Enterprise Linux versions. Additionally, review and restrict write access to the aci attribute to only users and service accounts that require it. Consider implementing additional monitoring on ACI modifications and heap memory corruption indicators. Verify patch version numbers against the official Red Hat security advisory before deployment.

Patch guidance

Monitor Red Hat security advisories for 389 Directory Server and Enterprise Linux updates addressing this flaw. Test patches in a non-production environment first, given the core role Directory Server often plays in identity infrastructure. After patching, verify that ACI parsing and access control policies function as expected. If immediate patching is not feasible, tighten access controls on the aci attribute as a compensating control.

Detection guidance

Monitor Directory Server logs for unusual ACI modifications, particularly from unexpected accounts or applications. Watch for crashes, memory corruption indicators, or service restarts that could indicate exploitation. Network-based detection is limited since traffic appears as normal LDAP writes; focus on access logs showing aci attribute modifications and behavioral anomalies in Directory Server process health. Consider heap sanitizers or memory debugging tools in test environments to identify potential exploitation signatures.

Why prioritize this

While the CVSS score of 5.4 (MEDIUM) reflects the requirement for authentication and write privileges, the silent nature of heap corruption and potential for service degradation warrant prompt attention. Organizations with strict access controls on aci attributes can deprioritize relative to unpatched remote-unauthenticated flaws, but should still plan patching within normal cycles. The lack of active exploitation (no KEV status) is a mitigating factor, but the critical role of Directory Server in many environments justifies measured urgency.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network attack vector with low complexity, required authentication, and no user interaction. The impact is limited to integrity and availability (no confidentiality loss), and the attack scope is unchanged. The authentication requirement and need for aci write privileges significantly reduce the attack surface compared to unauthenticated remote vulnerabilities, placing this in the MEDIUM severity band.

Frequently asked questions