A heap buffer overflow occurs in the create_masked_entry_string() function of 389 Directory Server’s auditlog.c when audit logging is enabled. The function copies a fixed-length password mask into a heap buffer without verifying available space. If a short cleartext password is logged – a scenario possible when non‑default CLEAR passwordStorageScheme is used or a replication peer is compromised – the buffer is overrun, corrupting heap memory and the audit log output. This corruption can lead to denial of service and potentially allow exploitation if memory is manipulated, but no direct read or arbitrary code execution capability is described in the CVE notes.

As listed by the CNA, affected products include Red Hat Directory Server versions 11, 12, and 13, and Red Hat Enterprise Linux distributions 6 through 10. No other vendors or versions are specified in the CVE entry.

The CVSS score of 3.3 indicates a low‑severity vulnerability with limited impact. The EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires audit logging to be enabled and a short cleartext password to be logged, typically through a misconfigured passwordStorageScheme or a malicious replication peer. These prerequisites lower the probability of successful exploitation, resulting in an overall low risk in most environments.