CVE-2026-12528: redhat 389_directory_server Out-of-bounds Write
Vulnerability summary
CVE-2026-12528 is a medium (CVSS 5.4) Out-of-bounds Write vulnerability in redhat 389_directory_server. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 17-06-2026PublishedVulnerability first disclosed.
- 17-06-2026Last modifiedVulnerability information updated.
Description
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat3 products
- 389_directory_serverna
- directory_server11.0 | 12.0 | 13.0
- enterprise_linuxEOL7.0 | 8.0 | 9.0 | 10.0
Debian1 product
- 389-ds-baseAll versions (No fix recorded)
Ubuntu1 product
- 389-ds-baseAll versions (No fix recorded)
3 vendors · 5 products
