REDHAT-BUG-2484913: Buffer Overflow

Two heap buffer overflow vulnerabilities exist in 389 Directory Server schema serialization code. Both are incomplete-fix variants of CVE-2025-14905: the ocsuperior (SUP) field length is omitted from buffer size calculations in readschemadse() and schemaoctostring(), but the field is still written via strcat().

Variant 1 (readschemadse, schema.c:1765): triggered during schema DSE reads; overflow at SUP >= ~248 bytes. Variant 2 (schemaoctostring, schema.c:5151): triggered during schema replication comparison; overflow at SUP >= ~62 bytes.

An attacker with Directory Manager privileges can crash the server. In replication topologies, a compromised supplier can push malicious schema to consumers. RCE is not feasible on x8664 due to ASCII-only overflow content.

Parent CVE: CVE-2025-14905 (fixed schemaattrenumcallback only). Advisory: 389-ds-campaign-2026-04/001-002-Schema-Heap-Overflow/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).