CVE-2026-18355: Integer Underflow (Wrap or Wraparound) in Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8

The vulnerability in 389 Directory Server's SASL I/O layer occurs in sasl_io_start_packet() where the wrapped-record length from the wire is only checked against an upper bound. Small wire lengths cause an unsigned subtraction underflow in sasl_io_read_packet(), leading to PR_Recv attempting to read approximately 4 GiB into a 1024-byte heap buffer. This heap buffer overflow can be triggered by a remote authenticated attacker after a successful SASL bind with integrity protection (SSF > 0), potentially resulting in denial of service or remote code execution. This issue is distinct from CVE-2026-11774 and has been rated with a CVSS 3.1 score of 7.5 (High). Red Hat has released a security update for 389-ds-base to fix this flaw as detailed in their advisory RHSA-2026:64771.

A remote authenticated attacker can exploit this vulnerability after a successful SASL bind with integrity protection to cause denial of service or potentially achieve remote code execution on affected systems running 389 Directory Server. The flaw allows a heap buffer overflow due to an integer underflow in the SASL I/O layer, which can lead to memory corruption and compromise of the server process.

Red Hat has released an official security update for 389-ds-base that fixes this vulnerability. Users should apply the update as described in Red Hat advisory RHSA-2026:64771 to remediate the issue. No additional mitigations are required beyond applying the official patch.