CVE-2026-12528
CVE-2026-12528 is a medium-severity vulnerability in Redhat Directory Server with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.
Key facts
- Severity: Medium (CVSS 3.x base score 5.4)
- EPSS exploit prediction: 0% (13th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-37728
- Weakness: CWE-787
- Affected product: Redhat Directory Server
- Published:
- Last modified:
Description
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
Frequently asked questions
- What is CVE-2026-12528?
- A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.
- How severe is CVE-2026-12528?
- CVE-2026-12528 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
- Is CVE-2026-12528 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-12528?
- CVE-2026-12528 primarily affects Redhat Directory Server. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-12528?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-12528 have an EU (EUVD) identifier?
- Yes. CVE-2026-12528 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-37728.
- When was CVE-2026-12528 published?
- CVE-2026-12528 was published on 2026-06-17 and last updated on 2026-06-28.
References
- https://access.redhat.com/security/cve/CVE-2026-12528
- https://bugzilla.redhat.com/show_bug.cgi?id=2489835
- https://github.com/389ds/389-ds-base/pull/7542
Affected products (8)
- cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
More vulnerabilities in Redhat Directory Server
- CVE-2008-2928 — Critical (CVSS 10.0): Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow…
- CVE-2008-0892 — Critical (CVSS 9.0): The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory…
- CVE-2008-3283 — High (CVSS 7.8): Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory…
- CVE-2026-9064 — High (CVSS 7.5): A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an…
- CVE-2022-1949 — High (CVSS 7.5): An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect…
- CVE-2010-2222 — High (CVSS 7.5): The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a…
All CVEs affecting Redhat Directory Server →
Other CWE-787 (Out-of-bounds Write) vulnerabilities
- CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
- CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src modules). This vulnerability is…
- CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
- CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
- CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
- CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…