CVE-2026-11884: 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the ocsuperior (SUP) field length is omitted from buffer size calculations in readschemadse() and schemaoctostring(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
Other sources
Two heap buffer overflow vulnerabilities exist in 389 Directory Server schema serialization code. Both are incomplete-fix variants of CVE-2025-14905: the ocsuperior (SUP) field length is omitted from buffer size calculations in readschemadse() and schemaoctostring(), but the field is still written via strcat().
Variant 1 (readschemadse, schema.c:1765): triggered during schema DSE reads; overflow at SUP >= ~248 bytes. Variant 2 (schemaoctostring, schema.c:5151): triggered during schema replication comparison; overflow at SUP >= ~62 bytes.
An attacker with Directory Manager privileges can crash the server. In replication topologies, a compromised supplier can push malicious schema to consumers. RCE is not feasible on x8664 due to ASCII-only overflow content.
Parent CVE: CVE-2025-14905 (fixed schemaattrenumcallback only). Advisory: 389-ds-campaign-2026-04/001-002-Schema-Heap-Overflow/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Patch 389-ds-campaign-2026-04/001-002-Schema-Heap-Overflow/advisory.md
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11884?
The severity of CVE-2026-11884 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-11884?
To fix CVE-2026-11884, you should upgrade to the latest version of the Red Hat 389 Directory Server that includes a patch for this vulnerability.
What kind of vulnerability is CVE-2026-11884?
CVE-2026-11884 is a heap buffer overflow vulnerability that occurs due to a flaw in objectclass serialization in the 389 Directory Server.
Can CVE-2026-11884 be exploited remotely?
Yes, CVE-2026-11884 can be exploited remotely by an attacker who has access to the Directory Server.
What risk does CVE-2026-11884 pose to my system?
CVE-2026-11884 poses a risk of a denial of service or arbitrary code execution due to the buffer overflow flaw.