Bug 2484913 (CVE-2026-11884)

Summary: CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aadhikar, bsmejkal, jachapma, mreynolds, progier, rhel-process-autobot, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-04 20:32:36 UTC 
Two heap buffer overflow vulnerabilities exist in 389 Directory Server schema serialization code. Both are incomplete-fix variants of CVE-2025-14905: the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat().

Variant 1 (read_schema_dse, schema.c:1765): triggered during schema DSE reads; overflow at SUP >= ~248 bytes.
Variant 2 (schema_oc_to_string, schema.c:5151): triggered during schema replication comparison; overflow at SUP >= ~62 bytes.

An attacker with Directory Manager privileges can crash the server. In replication topologies, a compromised supplier can push malicious schema to consumers. RCE is not feasible on x86_64 due to ASCII-only overflow content.

Parent CVE: CVE-2025-14905 (fixed schema_attr_enum_callback only). Advisory: 389-ds-campaign-2026-04/001-002-Schema-Heap-Overflow/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).