This vulnerability in Red Hat Directory Server 11 involves a heap buffer overflow caused by improper buffer size calculation when serializing objectclass definitions. Specifically, the oc_superior (SUP) field length is not accounted for in buffer size calculations in the functions read_schema_dse() and schema_oc_to_string(), but the field is still appended using strcat(), which can overflow the buffer. Exploitation requires Directory Manager privileges or control of a replication supplier. The flaw can cause a denial of service by crashing the server. It is an incomplete fix variant of CVE-2025-14905. The CVSS v3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Successful exploitation allows an attacker with Directory Manager privileges or a compromised replication supplier to cause a denial of service by crashing the Red Hat Directory Server 11. There is no confidentiality impact, but integrity and availability are highly impacted due to the buffer overflow leading to server crash.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11884 for current remediation guidance. No official fix or temporary workaround is stated in the provided advisory content. Until a patch is available, restrict Directory Manager privileges and secure replication suppliers to trusted entities to reduce risk.