Description

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content. After a successful SASL bind with integrity protection (SSF > 0), a remote authenticated attacker can cause a denial of service or potentially achieve remote code execution. This flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T15:17:30.867Z",
  "pubdate": "2026-09-07T15:17:30.867Z",
  "executiveSummary": "A critical heap buffer overflow vulnerability exists in the SASL I/O layer of 389 Directory Server (389-ds-base). The flaw is rooted in insufficient validation of wrapped-record lengths within the sasl_io_start_packet function, leading to an unsigned integer underflow during subsequent buffer processing. This vulnerability permits a remote authenticated attacker to trigger an out-of-bounds write of approximately 4 GiB of data into a fixed-size 1024-byte heap buffer.\nSuccessful exploitation allows an attacker to achieve remote code execution (RCE) or cause a denial of service (DoS) by crashing the directory server process. The vulnerability requires the attacker to have successfully completed a SASL bind with integrity protection (SSF > 0). Given the ability to inject attacker-controlled content into the heap via a massive PR_Recv operation, this flaw poses a severe security risk to infrastructure relying on 389 Directory Server for identity management and authentication.",
  "technicalDetails": "The vulnerability resides in the SASL I/O handling logic of the 389 Directory Server. Specifically, the function sasl_io_start_packet() performs input validation on the wrapped-record length provided over the wire, but it only checks against an upper bound. It fails to account for critically small values—specifically 0, 1, or 2—which are problematic in the subsequent execution flow.\nWhen a small wire length is provided, the encrypted_buffer_count calculation results in a value smaller than the already-consumed encrypted_buffer_offset. This discrepancy triggers an unsigned integer underflow during the calculations in sasl_io_read_packet(). Because this resulting value is interpreted by the system as a very large unsigned integer, the subsequent call to PR_Recv requests a read operation of approximately 4 GiB.\nThe target of this massive read operation is a statically allocated heap buffer of only 1024 bytes. This creates a classic heap buffer overflow condition where the attacker-controlled input from the wire is copied into the heap, overwriting adjacent memory structures, function pointers, or data objects. Because the content of the data read is controlled by the attacker, this primitive allows for precise control over the memory state of the application process.\nThe attack flow follows these steps: 1. The attacker performs a successful SASL bind with integrity protection (SSF > 0) to establish a state where the vulnerable code path is reachable. 2. The attacker crafts a malicious packet with a header length of 0, 1, or 2 to bypass the upper-bound validation in sasl_io_start_packet(). 3. The server proceeds to sasl_io_read_packet(), where the integer underflow forces an enormous buffer size calculation. 4. The application executes PR_Recv to read the attacker's payload into the 1024-byte heap buffer. 5. The heap overflow occurs as the system attempts to write the 4 GiB payload into the limited buffer, leading to process memory corruption. 6. The attacker leverages this corruption to hijack control flow, likely leading to arbitrary code execution within the context of the directory server service."
}