This vulnerability in Red Hat Directory Server 11 involves a heap buffer overflow caused by improper buffer size calculation when serializing objectclass definitions. Specifically, the oc_superior (SUP) field length is not accounted for in read_schema_dse() and schema_oc_to_string(), but the field is still concatenated into the buffer, leading to overflow. Exploitation requires Directory Manager privileges or a compromised replication supplier and results in a denial-of-service via server crash. This flaw is related to an incomplete fix of a previous vulnerability (CVE-2025-14905). The CVSS 3.1 base score is 6.5, reflecting medium severity with high impact on integrity and availability.

Successful exploitation can cause a denial-of-service condition by crashing the server. The integrity of the directory server can also be impacted due to the ability to manipulate objectclass definitions. No confidentiality impact is indicated. The attack requires high privileges (Directory Manager) or a compromised replication supplier, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-11884 for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict Directory Manager privileges and monitor for suspicious activity involving objectclass modifications.