The vulnerability in Red Hat Directory Server 11 involves the ldap_utf8prev() function, which reads memory before the start of a buffer without proper bounds checking. This causes a heap buffer over-read during the parsing of string filters, potentially influencing how internal filters are processed. The CVSS 3.1 base score is 5.0 (medium severity), with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no explicit vendor advisory statement on patch availability or remediation level, and no known exploits in the wild have been reported.

The heap buffer over-read may lead to unintended information disclosure or influence internal filter processing behavior, potentially affecting confidentiality, integrity, and availability at a low level. However, exploitation complexity is high and privileges required are low, limiting the ease of exploitation.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11787 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly.