CVE-2026-12528: 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()
A flaw was found in 389 Directory Server in the aclpnormalizeacltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
Other sources
Three related heap buffer overflow bugs were found in the aclpnormalizeacltxt() function in ldap/servers/plugins/acl/aclparse.c of 389 Directory Server. The function is called during ACI (Access Control Instruction) parsing via aclparse() -> aclpparseaci() -> aclpsanitycheckacltxt() -> aclpnormalizeacltxt().
The root cause is that aclpnormalizeacltxt() blindly assumes the ACI string after whitespace stripping still has at least 3 characters (the "aci" or "acl" keyword), without any bounds check. The assert(s) on line 850 only checks for NULL, not for an empty or too-short string, and asserts are compiled out in release builds (NDEBUG).
The three bugs are:
1. Out-of-bounds WRITE (1 byte): On line 852, (s + 2) = 'l' writes one byte past the heap buffer when the string is too short after whitespace stripping.
2. Out-of-bounds READ (strchr): On line 856, strchr(aclstr, ';') reads past the buffer because the NUL terminator was clobbered or the string lacks a semicolon.
3. Out-of-bounds READ (strdup): On line 866, slapichstrdup(aclName) reads past the buffer in strdup for the same root cause.
To trigger the vulnerability, an attacker needs write access to the 'aci' attribute on a directory entry. In the default modern configuration (389-ds-base 2.x / RHDS 12), only the Directory Manager can write ACIs. However, in older deployments or those using common ACI patterns with negated targetattr rules (e.g., targetattr!="userPassword") or wildcards (targetattr=""), any authenticated user may be able to write to the 'aci' attribute.
ASAN is not enabled in production release builds (the spec file defaults to %bcond asan 0 / %global useasan 0). In production binaries, the heap corruption is silent — the 1-byte write corrupts adjacent heap memory without a deterministic crash, and the OOB reads silently read garbage from adjacent heap allocations. The practical impact in production builds is likely negligible, making this primarily a hardening issue.
The 1-byte write primitive is not controllable (fixed value 'l'/0x6C at fixed offset +2 from a small allocation) and is not realistically weaponizable for code execution.
Upstream fix: https://github.com/389ds/389-ds-base/pull/7542 Upstream issue: https://github.com/389ds/389-ds-base/issues/7541
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Patch https://github.com/389ds/389-ds-base/pull/7542 - Configuration
Ensure only the Directory Manager can write ACIs (aci attribute). This reduces the requirement for an attacker to have write access to the 'aci' attribute to trigger __aclp__normalize_acltxt() parsing issues (e.g., avoid configurations that allow authenticated users with write access to aci).
389 Directory Server (aci attribute access control) Who can write to the aci attribute = Directory Manager only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12528?
CVE-2026-12528 has a medium severity rating of 5.4.
What systems are affected by CVE-2026-12528?
CVE-2026-12528 affects the 389 Directory Server software.
How can I fix CVE-2026-12528?
To fix CVE-2026-12528, you should update to the latest version of 389-ds-base that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-12528?
CVE-2026-12528 is classified as a buffer overflow vulnerability.
What impact does CVE-2026-12528 have on systems?
CVE-2026-12528 can lead to heap-buffer-overflows, allowing potential unauthorized read and write operations.