CVE-2026-18355: 389 Directory Server Buffer Overflow Flaw

CVE-2026-18355 Overview

A heap buffer overflow vulnerability affects the Simple Authentication and Security Layer (SASL) I/O layer of the 389 Directory Server (389-ds-base). The flaw resides in sasl_io_start_packet(), where the wrapped-record length read from the wire is validated only against an upper bound. When an attacker supplies a small wire length of 0, 1, or 2, an unsigned subtraction underflow occurs in sasl_io_read_packet(). This causes PR_Recv to be requested to read approximately 4 GiB into a 1024-byte heap buffer. The condition is classified under [CWE-191] Integer Underflow.

Critical Impact
A remote authenticated attacker with an active SASL bind using integrity protection (SSF > 0) can trigger denial of service or potentially achieve remote code execution with attacker-controlled heap content.

Affected Products

389 Directory Server (389-ds-base)
Red Hat Directory Server distributions covered by Red Hat CVE Analysis CVE-2026-18355
Red Hat Enterprise Linux packages listed across the RHSA-2026:64771 through RHSA-2026:65119 advisory series

Discovery Timeline

2026-09-07 - CVE CVE-2026-18355 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18355

Vulnerability Analysis

The flaw exists in the SASL I/O packet-handling path of 389 Directory Server. After a client completes a SASL bind negotiating integrity or confidentiality protection (Security Strength Factor greater than zero), all subsequent LDAP protocol data units are transmitted as SASL-wrapped records. The sasl_io_start_packet() function reads the wrapped-record length from the network but validates only that the value does not exceed an upper limit.

The vulnerability is distinct from the earlier CVE-2026-11774, whose patch addressed only the upper-bound overflow condition and left the lower bound unprotected.

Root Cause

The root cause is an unsigned integer underflow [CWE-191]. When the wire length is 0, 1, or 2, the computed encrypted_buffer_count falls below the already-consumed encrypted_buffer_offset. Subtracting these two unsigned values wraps to a very large positive number near 2^32. The resulting size is passed to PR_Recv, which then attempts to read roughly 4 GiB of attacker-controlled data into a fixed 1024-byte heap allocation.

Attack Vector

The attack is remote and requires an authenticated session. An attacker must first complete a successful SASL bind with a mechanism that negotiates integrity protection, such as GSSAPI or DIGEST-MD5 with auth-int or auth-conf. Once the SASL security layer is active, the attacker sends a crafted wrapped record with a length header value of 0, 1, or 2. The server underflows the receive-size calculation and reads a large volume of attacker-controlled bytes into an undersized heap buffer, corrupting adjacent heap metadata and object state.

No verified public exploit code is available. Refer to Red Hat Bug Report #2509186 for further technical detail.

Detection Methods for CVE-2026-18355

Indicators of Compromise

Unexpected ns-slapd process crashes or segmentation faults recorded in system logs after client SASL bind activity.
LDAP error log entries referencing SASL I/O failures, malformed packets, or truncated wrapped records.
Abnormally large PR_Recv read requests originating from the SASL I/O path in process memory instrumentation.

Detection Strategies

Monitor 389 Directory Server audit and error logs for SASL bind operations followed immediately by connection resets or daemon restarts.
Deploy runtime memory-safety instrumentation such as AddressSanitizer in non-production mirrors to surface heap overflow conditions during regression testing.
Correlate LDAP session telemetry with heap corruption or crash signatures on directory server hosts.

Monitoring Recommendations

Track authenticated LDAP sessions that negotiate SASL SSF greater than zero and alert on anomalous packet-length distributions.
Watch for repeated short-lived SASL-bound connections from a single principal, which may indicate exploitation attempts.
Ingest directory server logs into a centralized analytics platform to baseline normal SASL packet sizes and flag outliers.

How to Mitigate CVE-2026-18355

Immediate Actions Required

Apply the vendor updates published in the Red Hat Security Advisory series RHSA-2026:64771 through RHSA-2026:65119 to all affected 389-ds-base installations.
Inventory directory server deployments and confirm which SASL mechanisms are enabled, prioritizing servers that accept integrity or confidentiality-protected binds.
Restrict directory server network exposure to trusted management networks until patches are validated.

Patch Information

Red Hat has published fixed packages across multiple advisories, including RHSA-2026:64771, RHSA-2026:64776, RHSA-2026:64778, RHSA-2026:64790, RHSA-2026:64804, and RHSA-2026:65119. Consult the Red Hat CVE Analysis CVE-2026-18355 for the complete list of fixed package versions and to map each advisory to the appropriate product channel.

Workarounds

Disable SASL mechanisms that negotiate integrity or confidentiality protection where operationally feasible, forcing clients to plain simple binds over TLS instead.
Enforce strict network segmentation and firewall rules that limit which authenticated principals can reach LDAP ports 389 and 636.
Revoke or rotate credentials for service accounts that are not required to hold LDAP access while patches are being deployed.

bash

# Verify installed 389-ds-base version on Red Hat systems
rpm -q 389-ds-base

# After applying the vendor update, restart the directory server instance
systemctl restart dirsrv@<instance-name>