CVE-2026-11884 Memory corruption in Red Hat Directory Server 11
An attacker with Directory Manager privileges can cause a server crash via heap buffer overflow in schema serialization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11884?
CVE-2026-11884 is a medium-severity memory corruption vulnerability in Red Hat Directory Server 11, published on 10 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
Weakness: CWE-122
Which versions are affected by CVE-2026-11884?
How do I fix CVE-2026-11884?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-11884 being exploited?
There is no known exploitation of CVE-2026-11884 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-11884, GHSA-f4g5-r76v-qg3p, UBUNTU-CVE-2026-11884.