The vulnerability in Red Hat Directory Server 11 involves an integer underflow in the SASL I/O layer's sasl_io_read_packet() function. When the wrapped-record length read from the wire is very small (0, 1, or 2), the calculation of encrypted_buffer_count underflows below the encrypted_buffer_offset, causing PR_Recv to attempt reading approximately 4 GiB into a 1024-byte heap buffer. This heap buffer overflow allows an attacker who has successfully completed a SASL bind with integrity protection (SSF > 0) to cause denial of service or potentially execute arbitrary code remotely. The flaw is independent of CVE-2026-11774, which only addressed upper-bound overflow checks. Red Hat rates this issue as Important and has not identified a practical mitigation other than updating the affected package. Deployments not using SASL security layers after bind are not vulnerable on this path.

A remote authenticated attacker who has completed a SASL bind with integrity protection can exploit this vulnerability to cause a denial of service or potentially achieve remote code execution on the affected server. The flaw leads to heap buffer overflow with attacker-controlled content, impacting confidentiality, integrity, and availability. Systems not negotiating SASL security layers after bind are not affected by this vulnerability.

Red Hat has not identified any practical mitigation for this issue beyond applying the official fix. Users are strongly advised to update the affected package as soon as a fix is released. Deployments that do not negotiate a SASL security layer after bind are not exposed to this vulnerability. Monitor Red Hat's advisory page for patch availability and apply updates promptly once released.