Vulnpedia
← All CVEs

CVE-2026-11786

LOW 1.9

Published 2026-06-09 · Last modified 2026-06-30

A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 6th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

1.9CVSS 3.1 · LOW

  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires an admin / high-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-11786/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-11786/poc.json

Affected

Vendors Red Hat Redhat

Products Red Hat Directory Server 11 Red Hat Directory Server 12 Red Hat Directory Server 13 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Directory Server 389 Directory Server Enterprise Linux

Weakness (CWE)

  • CWE-125: Out-of-bounds Read

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Known Affected Software Configurations

VendorProductVersion range
RedhatDirectory Server11.0
RedhatDirectory Server12.0
RedhatDirectory Server13.0
Redhat389 Directory Server*
RedhatEnterprise Linux7.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux9.0
RedhatEnterprise Linux10.0

All CVSS metrics

  • LOW 1.9 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
  • LOW 1.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
  • MEDIUM 6.5 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Advisories

Sources: NVD · CVE.org · EPSS