An integer overflow in the SASL I/O layer of 389 Directory Server (389-ds-base) in Red Hat Directory Server 11 allows an attacker to bypass the nsslapd-maxsasliosize limit by causing an unsigned wraparound in packet length calculation. This leads to a heap buffer overflow of up to approximately 2 MB of attacker-controlled data. Exploitation requires a successful SASL bind with integrity protection (SSF > 0). The vulnerability enables remote attackers with valid Kerberos tickets, enrolled hosts, or service accounts in FreeIPA and Red Hat Identity Management environments to cause denial of service or remote code execution. This issue is distinct from CVE-2025-14905 and affects the sasl_io.c component.

The vulnerability allows remote attackers with valid credentials to cause a denial of service or potentially execute arbitrary code on affected Red Hat Directory Server 11 instances. The heap buffer overflow can be up to approximately 2 megabytes of attacker-controlled data, increasing the risk of remote code execution. This impacts deployments using FreeIPA and Red Hat Identity Management where domain users or service accounts can trigger the flaw over the network.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11774 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Until a patch is available, restrict access to the directory server to trusted users and monitor for unusual SASL bind activity.