A heap buffer overflow vulnerability exists in the schema_attr_enum_callback function of the 389-ds-base server component in Red Hat Directory Server 11.5 E4S for RHEL 8. The vulnerability arises because the code sums alias string lengths without accounting for additional formatting characters, causing an incorrect buffer size calculation. When processing a large number of aliases, this can lead to a heap overflow, enabling a remote attacker to cause Denial of Service or potentially execute arbitrary code remotely. Red Hat has issued security advisories RHSA-2026:3189 and RHSA-2026:3208 with updated 389-ds-base packages that fix this issue for Red Hat Enterprise Linux 9 and 10 respectively. The vulnerability affects versions >=9.0.0 <9.8 and >=10.0.0 <10.2 of the 389-ds-base package. The CVSS score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation of this heap buffer overflow vulnerability can allow a remote attacker with high privileges to cause a Denial of Service or achieve Remote Code Execution on affected systems running vulnerable versions of 389-ds-base. The vulnerability impacts confidentiality, integrity, and availability of the affected server. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updated 389-ds-base packages provided in Red Hat Enterprise Linux 9.8 and 10.2 or later as detailed in advisories RHSA-2026:3189 and RHSA-2026:3208. Refer to Red Hat's official article https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are required once the update is applied.