Vulnerability Description
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Directory Server | 11.0 |
| Redhat | 389 Directory Server | - |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2026-12528Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2489835Issue TrackingVendor Advisory
- https://github.com/389ds/389-ds-base/pull/7542Patch
FAQ
What is CVE-2026-12528?
CVE-2026-12528 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads...
How severe is CVE-2026-12528?
CVE-2026-12528 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-12528?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.