This vulnerability arises from two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler, which can lead to out-of-bounds memory access when handling oversized responses from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can intercept communications with the IdP endpoint may cause the daemon to read or write one byte beyond a fixed-size buffer. Successful exploitation requires specific conditions: FreeIPA must be configured with an external IdP, the attacker must control or man-in-the-middle the IdP endpoint, and a user must initiate the OAuth2 device authorization flow. The most likely consequence is a limited denial of service impacting the ipa-otpd daemon.

The vulnerability can cause out-of-bounds memory access, potentially leading to a limited denial of service condition affecting the ipa-otpd daemon. There is no indication of confidentiality or integrity impact. Exploitation requires attacker control or interception of the external IdP and user interaction to initiate the OAuth2 device authorization flow.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-14612 for current remediation guidance. Until a patch or official fix is available, mitigation involves ensuring the security and integrity of the external OAuth2/OIDC Identity Provider to prevent attacker control or man-in-the-middle attacks, and limiting exposure of the FreeIPA configuration to trusted IdPs only.