An integer overflow flaw was discovered in the SASL I/O layer of 389 Directory Server (389-ds-base). In the function sasl_io_start_packet, adding a 32‑bit integer to a crafted SASL packet length prefix of 0xFFFFFFFC triggers unsigned wrap‑around to zero, bypassing the nsslapd-maxsasliosize limit and creating a heap buffer overflow that can exceed 2 megabytes of attacker‑controlled data. After a successful SASL bind with integrity protection (SSF > 0), a remote attacker can cause a denial of service or achieve remote code execution. In FreeIPA and Red‑Hat Identity Management deployments, any domain user with a valid Kerberos ticket, enrolled host, or service account is able to trigger this vulnerability over the network, and the flaw is independent of CVE‑2025‑14905.

Affected systems include Red Hat Directory Server 11, 12, and 13 as well as Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10. The issue resides in the 389‑ds‑base product and applies to all listed RHEL distributions that install or rely on the Directory Server component.

The CVSS score of 7.6 classifies the vulnerability as high severity, but the EPSS score is not available and the flaw is not listed in CISA's KEV catalog. The likely attack vector requires only remote access to LDAP over standard ports 389 or 636 and an authenticated SASL bind, making it feasible in environments that expose these ports to untrusted networks or rely on FreeIPA or domain users with Kerberos tickets. Mitigation measures can reduce exposure but do not eliminate the issue; upgrading glibc on RHEL 8 reduces RCE exploitability but does not solve the denial‑of‑service potential.