CVE-2025-14905
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A heap buffer overflow vulnerability was found in the 389-ds-base server in the `schema_attr_enum_callback` function within `schema.c`. The flaw is due to incorrect buffer size calculation that sums alias string lengths without accounting for formatting characters, which can cause a heap overflow when processing many aliases.
Risk Assessment
A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE), potentially disrupting directory services and compromising the server.
Recommendation
Immediately update the 389-ds-base package to the latest patched version. Until the update is applied, restrict server access to trusted networks only.
Other vulnerabilities in 389-ds-base
See all- CVE-2017-7551Critical
389-ds-base versions before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
- CVE-2026-78701Medium
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.
- CVE-2026-18663Medium
A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.
- CVE-2026-16560Medium
A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.
- CVE-2026-14969Medium
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.
- CVE-2026-14940Medium
A heap-buffer-overflow vulnerability was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN.
- CVE-2026-11610High
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).
- CVE-2026-11774High
An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). Adding sizeof(uint32_t) to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data.
- CVE-2026-9064High
In 389-ds-base, the get_ldapmessage_controls_ext() function does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a crafted request with hundreds of thousands of minimal controls, causing excessive CPU consumption and heap allocation.
- CVE-2025-2487Medium
A flaw in the 389-ds-base LDAP Server occurs when the return value of a function is not checked during a Modify DN operation, leading to a NULL pointer dereference. A privileged user performing a MODDN operation after a failed operation can cause a Denial of Service (DoS) or system crash.
Original NVD description (English source)
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).