CVE-2026-18355: 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()
A flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasliostartpacket(), the 4-byte wrapped-record length read from the wire is validated only against an upper bound (the check added for CVE-2026-11774). When a SASL-authenticated attacker sends a wrapped record with a wire length of 0 (or 1 or 2), the resulting encryptedbuffercount (4, 5, or 6 after adding sizeof(uint32t)) is less than encryptedbufferoffset (7, the header bytes already consumed). The unsigned subtraction in saslioreadpacket() then underflows to approximately 0xFFFFFFFD, and PRRecv is requested to read roughly 4 GiB into the 1024-byte encryptedbuffer allocated in saslioinitbuffers(). This causes a heap buffer overflow with attacker-controlled length and content. The vulnerability requires authentication via a SASL bind with integrity protection (SSF > 0). This is a distinct defect from CVE-2026-11774, which only guards against lengths near UINT32MAX; the lower-end case is not covered and the vulnerability persists at HEAD.
Other sources
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasliostartpacket(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encryptedbuffercount below the already-consumed encryptedbufferoffset, causing an unsigned subtraction underflow in saslioreadpacket(). PRRecv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Patch CVE-2026-11774
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must first authenticate to the directory server using a SASL bind with integrity protection enabled (SSF greater than 0). It is therefore not exploitable by an unauthenticated network client based on the provided information.
Are deployments protected by the prior CVE-2026-11774 length check?
No. The prior check only rejects wrapped-record lengths near UINT32_MAX. This issue uses very small wire lengths, specifically 0, 1, or 2, which are not covered by that upper-bound validation.
What malformed input triggers the overflow?
The attacker sends a SASL wrapped record whose 4-byte wire length is 0, 1, or 2. After header processing, an unsigned length calculation underflows and can cause a receive request of roughly 4 GiB into a 1024-byte heap buffer.
How can administrators assess exposure?
Assess whether the server accepts SASL-authenticated binds with integrity protection, meaning SSF is greater than 0. Systems without such SASL-protected sessions are not described as reachable through this flaw.