CVE-2026-18355389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

Description

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.

Timeline

Scores

EPSS (exploitation in 30 days)

0.84% · top 42% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8

  • unaffected 8060020260908152739.0ca98e7e – < *

• Red Hat · Red Hat Directory Server 11.7 E4S for RHEL 8

  • unaffected 8080020260903102346.f969626e – < *

• Red Hat · Red Hat Directory Server 11.9 for RHEL 8

  • unaffected 8100020260904171440.37ed7c03 – < *

• Red Hat · Red Hat Directory Server 12.2 E4S for RHEL 9

  • unaffected 9020020260903155914.1674d574 – < *

• Red Hat · Red Hat Directory Server 12.4 E4S for RHEL 9

  • unaffected 9040020260903102623.1674d574 – < *

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.2.0-10.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:3.0.6-21.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:1.3.11.1-15.el7_9 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 8100020260904155442.25e700aa – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 8040020260901171549.96015a92 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 8040020260901171549.96015a92 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 8060020260901145727.824efc52 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 8060020260901145727.824efc52 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 8080020260831180218.6dbb3803 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 8080020260831180218.6dbb3803 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.8.0-10.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:2.2.4-22.el9_2 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:2.4.5-29.el9_4 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:2.6.1-24.el9_6 – < *

• Red Hat · Red Hat Directory Server 13.2

  • unaffected 1788851765 – < *

• Red Hat · Red Hat Directory Server 12

  All versions: affected

• Red Hat · Red Hat Directory Server 13

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

What to do

Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-72455 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-18355](https://cveledger.app/badge/CVE-2026-18355.svg)](https://cveledger.app/cve/CVE-2026-18355)

Record last updated 4 Nov 2026, 22:11 UTC.