A flaw in 389 Directory Server causes the ldap_utf8prev() function to read bytes before the start of a buffer during string filter parsing, resulting in a heap buffer over‑read identified as CWE‑126. When an LDAP client sends a specially crafted filter, the server can access memory outside the intended buffer, potentially revealing sensitive data or corrupting internal state. The effect on confidentiality, integrity, or availability is limited to data leakage or the disruption of filter processing, which may lead to incorrect search results or a denial of service.

The vulnerability affects Red Hat Directory Server 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10, all of which include the 389‑ds‑base component.

The CVSS score of 5.0 indicates moderate severity, and the EPSS score is not available while the CVE is not listed in CISA KEV. Exploitation requires an LDAP client that can send explicit search filters to the server; the over‑read itself does not provide remote code execution but can cause data exposure or DoS. Network‑level mitigations such as proxies or WAFs are ineffective against this code‑level bug, so the primary risk remains for systems exposed to LDAP traffic where arbitrary filters can be sent.