The flaw arises in the 389 Directory Server where the get_ruvelement_from_berval() routine copies digit characters from a client‑supplied replica ID into a 16‑byte stack buffer without bounds checking. This results in a stack buffer overflow that can crash the LDAP server before any authentication occurs. The mitigation provided by compile‑time stack protectors limits the impact to a denial of service rather than arbitrary code execution.

Affected products include Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux distributions 6, 7, 8, 9, and 10. Services running these versions are vulnerable if they process replication requests containing over‑long replica IDs.

The vulnerability can be exploited by any external actor able to reach the LDAP service to send a specially crafted StartNSDS50ReplicationRequest with a replica ID longer than 16 digits. Because the overflow occurs before authentication and no privilege escalation is possible, the primary risk is service interruption. The CSIS EPSS score is under 1 percent, indicating a low current exploitation probability, and the vulnerability is not listed in the KEV catalog. Nonetheless, the CVSS score of 7.5 represents a moderate‑to‑high severity for a denial‑of‑service condition.