A buffer overflow occurs when 389 Directory Server parses a malformed Access Control Instruction. The __aclp__normalize_acltxt() function does not verify the length of an ACI keyword after whitespace stripping, allowing a one-byte write beyond the allocated buffer and subsequent reads outside bounds. An authenticated user who can write the aci attribute can supply a crafted ACI value, resulting in corruption of heap memory within the directory server process.

The vulnerability affects Red Hat Directory Server versions 11, 12, and 13 and all Red Hat Enterprise Linux releases from 6 to 10 that include the 389-ds-base package. The affected products are listed as Red Hat Directory Server 11-13 and RHEL 6-10, as identified by the CNA.

The CVSS score of 5.4 indicates medium severity. The EPSS score is below 1 %, suggesting low likelihood of widespread exploitation, and the vulnerability is not currently in the CISA KEV catalog. Attack requires an authenticated user with write access to the aci attribute; if write permissions are overly permissive, the flaw can be exploited without elevated privilege. Successful exploitation would corrupt the server’s heap memory and could lead to process instability.