CVE-2026-18355 Red Hat CVE debrief

Who should care

Defenders of 389 Directory Server (389-ds-base) deployments should assess exposure and potential impact due to the heap buffer overflow flaw in the SASL I/O layer. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify system configurations, apply compensating controls, and review monitoring and detection logs for exposed assets.

Why it matters

Defenders of 389 Directory Server (389-ds-base) deployments should assess exposure and potential impact due to a heap buffer overflow flaw in the SASL I/O layer.

• Denial of service due to heap buffer overflow
• Potential remote code execution after successful SASL bind

Technical summary

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). The flaw occurs in sasl_io_start_packet(), where the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet(). PR_Recv is then requested to read approximately 4 GiB into a 1024-byte heap buffer, resulting in a heap buffer overflow with attacker-controlled content.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify exposure by checking system configurations and versions
• Assess potential impact on remote authenticated attackers
• Implement compensating controls to prevent exploitation
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the heap buffer overflow flaw. Evidence is limited to public CVE and NVD information. Defenders should verify system configurations, versions, and apply compensating controls where exposure is confirmed. The CVE record was published on 2026-09-07T15:17:30.867Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.