CVE-2026-14612: Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.
Other sources
Two related off-by-one memory safety bugs in the FreeIPA ipa-otpd daemon, in oauth2onchildreadable() (daemons/ipa-otpd/oauth2.c). Confirmed by reporter with AddressSanitizer on minimal reproducers. Verified against upstream master (2026-07-03): vulnerable code still present.
Bug #1 — Out-of-bounds write (CWE-787), oauth2.c ~line 282 static char buf[10240]; io = read(vertogetfd(ev), buf, 10240); if (io >= 0) { buf[io] = '\0'; // OOB when io == 10240 }
Bug #2 — Out-of-bounds read (CWE-125), oauth2.c ~line 305 radreply = memchr(buf, '\n', io); if (radreply != NULL) { radreply = '\0'; radreply++; end = memchr(radreply, '\n', io - (radreply - 1 - buf)); // off by 1 }
Prerequisites: 1. FreeIPA configured with external IdP (ipa idp-add) 2. Attacker controls IdP endpoint or can MITM IdP traffic 3. A domain user initiates OAuth2 device authorization (kinit / IdP-backed account)
Requirements to exploit: No FreeIPA admin credentials required on attacker side. Attacker operates at the IdP layer. User interaction required to start the OAuth2 device flow. Exploitation preconditions are non-trivial (IdP control/MITM + configured IdP).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14612?
CVE-2026-14612 has a medium severity rating of 4.2.
How do I fix CVE-2026-14612?
To mitigate CVE-2026-14612, update the FreeIPA ipa-otpd software to the latest patched version.
What vulnerabilities are associated with CVE-2026-14612?
CVE-2026-14612 involves off-by-one buffer overflows that may lead to out-of-bounds memory access.
What attack vectors are possible with CVE-2026-14612?
An attacker can exploit CVE-2026-14612 if they control or can intercept traffic to the Identity Provider endpoint.
What software is affected by CVE-2026-14612?
CVE-2026-14612 affects the FreeIPA ipa-otpd daemon.