The vulnerability in 389 Directory Server is a heap buffer overflow occurring during the serialization of objectclass definitions. When the oc_superior (SUP) field length is omitted from the buffer size calculations, the field is still written via strcat(), allowing an attacker to overflow the buffer. A crash of the Directory Server can result, disrupting directory services and availability.

Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10 are affected. The CVE does not specify a particular patch level, so all current installations of these products are vulnerable until addressed through official remediation or consulting the vendor for an update.

The CVSS score of 6.5 indicates a medium severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Exploitation requires Directory Manager privileges or a compromised replication supplier, which limits the attack surface to trusted administrative or replicated components. The risk is therefore moderate, with the primary impact being a service crash rather than data compromise.