CVE-2026-12528: 389 Directory Server Buffer Overflow Flaw

CVE-2026-12528 Overview

CVE-2026-12528 is a heap buffer overflow vulnerability in the 389 Directory Server, an enterprise Lightweight Directory Access Protocol (LDAP) implementation. The flaw resides in the __aclp__normalize_acltxt() function within aclparse.c. A malformed Access Control Instruction (ACI) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping. This results in a 1-byte out-of-bounds write and subsequent out-of-bounds reads [CWE-787]. An authenticated user with write access to the aci attribute can silently corrupt heap memory in the directory server process.

Critical Impact
Authenticated users with write access to the aci attribute can corrupt heap memory in the 389 Directory Server process, potentially affecting directory integrity and availability.

Affected Products

389 Directory Server (upstream 389-ds-base)
Red Hat Directory Server distributions including the vulnerable aclparse.c
Downstream LDAP products built on 389-ds-base prior to the patch in pull request #7542

Discovery Timeline

2026-06-17 - CVE-2026-12528 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12528

Vulnerability Analysis

The vulnerability resides in the ACI parser of 389 Directory Server. The __aclp__normalize_acltxt() function in aclparse.c processes ACI strings stored in the aci attribute of directory entries. During normalization, the function strips surrounding whitespace from ACI keywords without verifying that any characters remain. When a keyword reduces to an empty or near-empty token, subsequent pointer arithmetic indexes one byte beyond the allocated buffer.

The consequence is a 1-byte out-of-bounds write, followed by out-of-bounds reads as parsing continues. Heap memory adjacent to the ACI buffer can be silently corrupted. Because the directory server runs as a long-lived process serving multiple clients, corrupted heap structures may produce delayed crashes, integrity issues, or denial of service.

Exploitation requires authentication and write privileges to the aci attribute, which restricts the attack surface to administrators or delegated users. The network attack vector still applies because LDAP modify operations traverse the network.

Root Cause

The root cause is missing input validation. The parser assumes a non-empty keyword after whitespace stripping but does not enforce a minimum length check before dereferencing or writing to the resulting offset. This boundary condition omission produces the out-of-bounds memory access.

Attack Vector

An authenticated attacker submits an LDAP modify operation targeting the aci attribute on a directory entry. The crafted ACI value contains a keyword field constructed so that whitespace normalization leaves insufficient characters. When the server parses the value, the heap-buffer-overflow write occurs in the ns-slapd process address space. No user interaction is required beyond the attacker's own LDAP request.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-12528 Advisory and the GitHub Pull Request #7542 for the patch diff and technical details.

Detection Methods for CVE-2026-12528

Indicators of Compromise

Unexpected ns-slapd process crashes or restarts following LDAP modify operations on the aci attribute
Heap corruption signatures in core dumps from the directory server process
LDAP audit log entries showing modifications to aci containing malformed or unusually short keyword tokens

Detection Strategies

Enable 389 Directory Server access and audit logging to capture all modify operations targeting the aci attribute, including the submitted values
Monitor ns-slapd for abnormal termination signals or AddressSanitizer reports in test environments
Review LDAP change logs for ACI values containing suspicious whitespace patterns or truncated keywords

Monitoring Recommendations

Alert on any write to the aci attribute from accounts that do not routinely manage access control
Track directory server process restarts and correlate them with preceding LDAP operations
Aggregate LDAP audit logs into a centralized SIEM for retention and pattern analysis across the directory infrastructure

How to Mitigate CVE-2026-12528

Immediate Actions Required

Apply vendor updates for 389-ds-base that include the fix from GitHub Pull Request #7542 as soon as packages are available from your distribution
Audit accounts holding write access to the aci attribute and remove unnecessary privileges
Restrict LDAP modify access to the aci attribute to a minimal set of administrative principals

Patch Information

The upstream fix is tracked in the 389-ds-base repository in GitHub Pull Request #7542. Red Hat tracks the issue in Red Hat Bug Report #2489835 and publishes errata through the Red Hat CVE-2026-12528 Advisory. Administrators should consult their distribution's package repository for fixed builds of 389-ds-base.

Workarounds

Limit network reachability of the LDAP service to trusted management networks until patches are applied
Enforce strict ACL review processes so that only vetted ACI strings are committed to the directory
Use a staging directory instance to validate ACI changes before promoting them to production

bash

# Configuration example: restrict who can write the aci attribute
# Apply via ldapmodify on a staging instance, then promote after review
dn: dc=example,dc=com
changetype: modify
add: aci
aci: (targetattr="aci")(version 3.0; acl "Restrict ACI writes";
  allow (write) userdn="ldap:///cn=acl-admins,ou=Groups,dc=example,dc=com";)