A type confusion in the SSO token extended operation handler of 389 Directory Server allows an authenticated LDAP client to receive partial stack address information in its responses. The flaw is triggered when the server processes the SSO token request, making it possible for any authenticated LDAP client to receive low‑level stack memory data. Because the information disclosed is limited to stack addresses rather than credentials or other sensitive data, the impact is restricted to a confidentiality leak.

The vulnerability affects Red Hat Directory Server versions 11, 12 and 13, as well as Red Hat Enterprise Linux releases 10, 6, 7, 8 and 9. All affected systems that have SSOToken enabled are susceptible; disabling the feature removes the vulnerable code path.

The CVSS score of 4.3 indicates moderate impact with a limited exploitation scope. The EPSS score is not available, so the current likelihood of exploitation is undetermined but presumed low, especially since the attack requires an authenticated LDAP session and the flaw manifests only through the SSO token extended operation. The vulnerability is not listed in the CISA KEV catalog at this time, further suggesting that widespread exploitation is not documented. The primary attack vector is an authenticated LDAP client sending a request that triggers the vulnerable handler; no public exploit code is known.