The vulnerability exists in the 389 Directory Server component of Red Hat Directory Server 11, specifically in the __aclp__normalize_acltxt() function within aclparse.c. A malformed Access Control Instruction (ACI) string can trigger heap-buffer-overflow writes and reads because the function does not properly validate the length of the ACI keyword after whitespace is stripped. This results in a 1-byte out-of-bounds write followed by out-of-bounds reads. An attacker who is authenticated and has write permissions to the aci attribute can exploit this flaw by sending a crafted ACI value, causing silent heap memory corruption in the directory server process.

The vulnerability allows an authenticated user with write access to the aci attribute to corrupt heap memory silently in the directory server process. This can lead to integrity and availability impacts, such as potential crashes or unpredictable behavior of the directory server. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12528 for current remediation guidance. Until a patch is available, restrict write access to the aci attribute to trusted users only to reduce the risk of exploitation.