A heap buffer overflow (CWE-122) exists in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can transmit an oversized LDAP UNBIND packet. The packet is copied into a 512‑byte heap receive buffer without bounds checking in sasl_io_recv(), allowing the attacker to inject roughly 2 MB of data. The overflow crashes the server, causing a denial of service. In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger the vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since about 2013 (389‑ds‑base 1.3.2) and was not fixed by the earlier CVE‑2025‑14905 heap overflow patch.

The vulnerability affects all supported Red Hat Directory Server releases from 11 through 13, including the E4S variants, and spans Red Hat Enterprise Linux 6, 7, 8, 9 and 10. It also applies to FreeIPA and Red Hat Identity Management deployments that employ Kerberos/GSSAPI authentication, permitting any domain user with a valid Kerberos ticket, enrolled host, or any service account to trigger the crash over the network.

Based on the description, it is inferred that the attack vector is a network-based attacker who first authenticates via SASL and then sends an oversized LDAP UNBIND packet. The CVSS score of 8.8 reflects a high‑severity flaw; the EPSS score of < 1 % suggests a low current probability of exploitation. The vulnerability requires access to LDAP ports 389 or 636 over the network and an authenticated SASL session, making the attack vector a trusted internal or external attacker who has SASL credentials. Once the attacker sends the crafted UNBIND packet, the server crashes, impacting the entire directory service’s availability. The flaw is not listed in CISA KEV. No complete workaround exists beyond the mitigation steps listed.