CVE-2026-14612: Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization

Published Jul 3, 2026
·
Updated

Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.

Other sources

Two related off-by-one memory safety bugs in the FreeIPA ipa-otpd daemon, in oauth2onchildreadable() (daemons/ipa-otpd/oauth2.c). Confirmed by reporter with AddressSanitizer on minimal reproducers. Verified against upstream master (2026-07-03): vulnerable code still present.

Bug #1 — Out-of-bounds write (CWE-787), oauth2.c ~line 282 static char buf[10240]; io = read(vertogetfd(ev), buf, 10240); if (io >= 0) { buf[io] = '\0'; // OOB when io == 10240 }

Bug #2 — Out-of-bounds read (CWE-125), oauth2.c ~line 305 radreply = memchr(buf, '\n', io); if (radreply != NULL) { radreply = '\0'; radreply++; end = memchr(radreply, '\n', io - (radreply - 1 - buf)); // off by 1 }

Prerequisites: 1. FreeIPA configured with external IdP (ipa idp-add) 2. Attacker controls IdP endpoint or can MITM IdP traffic 3. A domain user initiates OAuth2 device authorization (kinit / IdP-backed account)

Requirements to exploit: No FreeIPA admin credentials required on attacker side. Attacker operates at the IdP layer. User interaction required to start the OAuth2 device flow. Exploitation preconditions are non-trivial (IdP control/MITM + configured IdP).

Red Hat

Affected Software

1 affected component
FreeIPA ipa-otpd

Event History

Jul 3, 2026
Data Sourced
via Red Hat·02:53 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·03:11 PM
Data Sourced
via MITRE·03:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-14612?

CVE-2026-14612 has a medium severity rating of 4.2.

2

How do I fix CVE-2026-14612?

To mitigate CVE-2026-14612, update the FreeIPA ipa-otpd software to the latest patched version.

3

What vulnerabilities are associated with CVE-2026-14612?

CVE-2026-14612 involves off-by-one buffer overflows that may lead to out-of-bounds memory access.

4

What attack vectors are possible with CVE-2026-14612?

An attacker can exploit CVE-2026-14612 if they control or can intercept traffic to the Identity Provider endpoint.

5

What software is affected by CVE-2026-14612?

CVE-2026-14612 affects the FreeIPA ipa-otpd daemon.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203