A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). (CVE-2026-18355)

CVE-2026-18355 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base). The flaw arises in sasl_io_start_packet() where the wrapped-record length read from the network is only validated against an upper bound. When a small length (0, 1, or 2) is received, it causes an unsigned subtraction underflow in sasl_io_read_packet(), leading to a request to read approximately 4 GiB into a 1024-byte heap buffer. This results in a heap buffer overflow with attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can exploit this to cause denial of service or potentially execute arbitrary code. This vulnerability is independent of CVE-2026-11774, which only addressed upper-bound overflow. Red Hat has issued a critical security advisory with patches for affected versions of 389-ds-base on Red Hat Enterprise Linux 7 Extended Lifecycle Support.

The vulnerability allows a remote authenticated attacker, after successful SASL bind with integrity protection, to cause a heap buffer overflow by sending a specially crafted SASL wrapped record with a small length prefix. This can lead to denial of service (crash or resource exhaustion) or potentially remote code execution, impacting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update for 389-ds-base that addresses this vulnerability. Users should apply the update as soon as possible to remediate the issue. No practical mitigations other than applying the patch have been identified. Deployments that do not negotiate a SASL security layer after bind are not exposed on this path.