Description

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-07-22T14:17:18.043Z",
  "pubdate": "2026-07-22T14:17:18.043Z",
  "executiveSummary": "A heap-buffer-overflow vulnerability has been identified in Directory Server (389-ds-base). The flaw arises from improper memory management when processing Distinguished Names (DNs) containing legacy-quoted values. Specifically, the server fails to close the corresponding heap allocation, resulting in a dangling pointer scenario where subsequent function calls reference the same memory location.\nThe primary impact of this vulnerability includes the potential for a denial of service (DoS) condition or arbitrary memory write operations. Successful exploitation could compromise the availability and integrity of the affected Directory Server instance. The vulnerability affects the 389-ds-base product family. Exploitation typically requires an attacker to interact with the directory service by supplying specially crafted DN inputs containing legacy-quoted values to trigger the memory corruption sequence.",
  "technicalDetails": "The vulnerability is rooted in a memory management defect within the Directory Server (389-ds-base) codebase, specifically handling Distinguished Name (DN) parsing logic when legacy-quoted values are encountered. During the parsing operation, the server allocates a heap buffer to process the input value but fails to correctly release or close the heap allocation upon completion or error handling.\nBecause the heap allocation remains active and unmanaged, a subsequent operational call within the server execution flow can reference the exact same memory pointer. This reuse of a dangling pointer leads to a classic heap-buffer-overflow condition. Depending on the precise sequence of operations and the contents written to the recycled memory chunk, an attacker can induce application instability, triggering a denial of service through application crashes, or potentially achieve arbitrary memory write operations.\nThe attack flow proceeds as follows: 1. An unauthenticated or authenticated client submits a malicious LDAP query or administrative request containing a crafted DN with a legacy-quoted value. 2. The Directory Server parser processes the input, allocating heap memory for the legacy-quoted value. 3. Due to the logic flaw, the allocation is left open and accessible. 4. A subsequent internal call references the dangling pointer, writing data to the previously allocated memory space. 5. This results in heap corruption, leading to abnormal termination (denial of service) or memory overwrite conditions that could alter execution flow if leveraged effectively."
}