CVE-2026-11792 is a heap buffer overflow vulnerability in Red Hat Directory Server 11 (389 Directory Server). When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a heap buffer sized precisely for the data, but it does not check if the buffer has enough space. If a short cleartext password is logged—possible only with non-default CLEAR password storage or a compromised replication peer—this results in a buffer overflow that corrupts heap memory and audit log output. The CVSS v3.1 score is 3.3 (low severity) with network attack vector, high attack complexity, requiring high privileges, no user interaction, and limited impact on integrity and availability.

The vulnerability can cause heap memory corruption and corrupted audit log output when a short cleartext password is logged. This may affect the reliability of audit logs and could potentially lead to denial of service or other stability issues. There is no indication of confidentiality impact or remote exploitation without high privileges. No known exploits are reported in the wild.

Red Hat has published advisories for this issue (RHBA-2025:15534) with updated packages for 389-ds-base on Red Hat Enterprise Linux 9. Users should apply the official Red Hat updates to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the vendor-provided fix.