An integer overflow in sasl_io_start_packet() of 389 Directory Server's SASL I/O layer allows an attacker to bypass the nsslapd-maxsasliosize limit by causing an unsigned wraparound when adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC. This leads to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause denial of service or achieve remote code execution. In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account can exploit this vulnerability over the network. This issue is distinct from CVE-2025-14905 and affects 389-ds-base versions >=9.0.0 <9.8 and >=10.0.0 <10.2. Red Hat has issued security advisories RHSA-2026:36195 and RHSA-2026:36196 providing updated packages that fix this vulnerability.

Successful exploitation can lead to denial of service or remote code execution on affected systems running vulnerable versions of 389 Directory Server. The vulnerability allows an attacker with valid SASL bind credentials and integrity protection to bypass packet size limits and overflow heap buffers with attacker-controlled data. This elevates the risk of system compromise or service disruption in environments using Red Hat Directory Server, FreeIPA, or Red Hat Identity Management.

Red Hat has released official security updates that fix this vulnerability in 389-ds-base packages for Red Hat Enterprise Linux 9 and 10. Users should apply these updates as described in Red Hat advisories RHSA-2026:36195 and RHSA-2026:36196. The advisories provide detailed instructions and updated package versions. Applying these patches mitigates the vulnerability. There are no vendor statements indicating that no action is required or that the issue is already mitigated without patching.