CVE-2026-18355
Received Received - Intake

Heap Buffer Overflow in 389 Directory Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-18355
EUVD
EUVD-2026-72455

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat 389_directory_server *
redhat 389_directory_server to latest (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18355 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server. It occurs in the sasl_io_start_packet() function where a small wrapped-record length (0, 1, or 2 bytes) read from the network causes an unsigned integer underflow. This leads to a request to read approximately 4 GiB of data into a 1024-byte buffer, resulting in a heap buffer overflow with attacker-controlled content.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption in 389 Directory Server processes, particularly after SASL authentication attempts. Check logs for errors in sasl_io_start_packet() or sasl_io_read_packet() functions. Use network monitoring tools to inspect SASL traffic for malformed wrapped-record lengths (0, 1, or 2 bytes).

Commands to check for vulnerable versions: rpm -q 389-ds-base or dnf list installed 389-ds-base. Monitor system logs for segmentation faults or heap corruption errors in the 389-ds process.

Impact Analysis

An authenticated remote attacker can exploit this flaw after a successful SASL bind with integrity protection to cause a denial of service or potentially achieve remote code execution. The impact includes unauthorized data access, system compromise, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Successful exploitation may result in non-compliance due to data breaches or loss of data protection controls.

Mitigation Strategies

Immediately update the 389 Directory Server to the latest patched version. If updating is not immediately possible, disable SASL authentication with integrity protection (SSF > 0) as a temporary workaround. Restrict network access to the directory server to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart