CVE-2026-12528: Out-of-bounds Write in Red Hat Red Hat Directory Server 11
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
AI Analysis
Technical Summary
This vulnerability exists in the 389 Directory Server component of Red Hat Directory Server 11, specifically in the __aclp__normalize_acltxt() function within aclparse.c. The function does not properly validate the length of the ACI keyword after whitespace stripping, which leads to a 1-byte out-of-bounds write and subsequent out-of-bounds reads on the heap. An attacker with authenticated write privileges to the aci attribute can exploit this by submitting a crafted ACI string, causing heap memory corruption in the directory server process.
Potential Impact
The vulnerability allows an authenticated user with write access to the aci attribute to perform a heap-buffer-overflow write and read, resulting in silent heap memory corruption. This can lead to integrity loss and potential denial of service (application crash) of the directory server process. Confidentiality is not impacted according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12528 for current remediation guidance. Until a patch is available, restrict write access to the aci attribute to trusted users only to reduce the risk of exploitation.
CVE-2026-12528: Out-of-bounds Write in Red Hat Red Hat Directory Server 11
Description
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
CVSS v3.1
Score 5.4medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the 389 Directory Server component of Red Hat Directory Server 11, specifically in the __aclp__normalize_acltxt() function within aclparse.c. The function does not properly validate the length of the ACI keyword after whitespace stripping, which leads to a 1-byte out-of-bounds write and subsequent out-of-bounds reads on the heap. An attacker with authenticated write privileges to the aci attribute can exploit this by submitting a crafted ACI string, causing heap memory corruption in the directory server process.
Potential Impact
The vulnerability allows an authenticated user with write access to the aci attribute to perform a heap-buffer-overflow write and read, resulting in silent heap memory corruption. This can lead to integrity loss and potential denial of service (application crash) of the directory server process. Confidentiality is not impacted according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12528 for current remediation guidance. Until a patch is available, restrict write access to the aci attribute to trusted users only to reduce the risk of exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-17T13:48:38.528Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-12528","vendor":"Red Hat"}]
Threat ID: 6a32b81b9f87a2db090fc480
Added to database: 06/17/2026, 15:07:07 UTC
Last enriched: 06/24/2026, 16:10:58 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.