CVE-2026-11774: 389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasliostartpacket(), adding sizeof(uint32t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can trigger this vulnerability over the network. This flaw is independent of CVE-2025-14905, which patched schema.c only and did not modify saslio.c.
Other sources
An integer overflow in the 389 Directory Server SASL I/O layer allows any SASL-authenticated user to bypass the nsslapd-maxsasliosize packet size limit and crash the LDAP server, with potential code execution on older platforms (RCE demonstrated on RHEL 8 via tcache poisoning).
After authenticating with Kerberos or DIGEST-MD5, an attacker sends a SASL-framed packet with a crafted 4-byte length prefix of 0xFFFFFFFC. In sasliostartpacket() (saslio.c:372-374), packetlength += sizeof(uint32t) wraps to 0, bypassing the size limit check. saslioreadpacket() then computes bytesremaining underflow, and NSPR passes a near-maximum recv() size into a 1024-byte encryptedbuffer — a controlled heap buffer overflow of up to maxbersize (~2MB).
In FreeIPA/IdM deployments, any domain user with a Kerberos ticket, enrolled host, or service account can trigger this remotely.
Introduced when the SASL I/O layer was first added to 389-ds-base. Independent of Finding 008 (different code path in same file). CVE-2025-14905 fix patched schema.c only; saslio.c untouched.
DoS confirmed on Fedora 42 (GDB-verified) and RHEL 8 production binary. RCE demonstrated on RHEL 8 (glibc 2.28) via tcache poisoning; blocked on glibc 2.32+ by safe linking.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11774?
The severity of CVE-2026-11774 is rated high with a Base Score of 7.6.
How do I fix CVE-2026-11774?
To fix CVE-2026-11774, update to the patched version of 389-ds-base provided by the 389 Project.
What are the potential impacts of CVE-2026-11774?
CVE-2026-11774 can lead to a heap buffer overflow, which may allow an attacker to execute arbitrary code.
Which software is affected by CVE-2026-11774?
CVE-2026-11774 affects the 389-ds-base software from the 389 Project and Red Hat.
What is the main cause of CVE-2026-11774?
CVE-2026-11774 is caused by an integer overflow in the SASL I/O layer of the 389 Directory Server.