A type confusion vulnerability exists in the SSO token extended operation handler of Red Hat Directory Server 11 (389 Directory Server). This flaw causes partial disclosure of stack address information in LDAP responses when accessed by authenticated users. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official remediation level or patch information is provided in the vendor advisory at this time.

Authenticated users can obtain partial stack address information via LDAP responses, which may aid in further attacks such as information gathering or exploitation of memory corruption vulnerabilities. There is no indication of direct impact on data integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11785 for current remediation guidance. Until a fix is available, limit LDAP access to trusted authenticated users and monitor for unusual activity related to SSO token operations.