The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5_LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11_DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.

An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5_pwd.c and pbkdf2_pwd.c but not smd5_pwd.c.

Present since smd5_pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.