CVE-2026-11786
LowCVSS 1.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In 389 Directory Server, the LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
Risk Assessment
The risk is potential disclosure of sensitive data or server crash due to out-of-bounds read, which could be exploited for denial of service or information leakage.
Recommendation
It is recommended to update 389 Directory Server to the latest version containing a fix for this vulnerability.
Original NVD description (English source)
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.