A heap-buffer-overflow in 389-ds-base occurs when a distinguished name containing a legacy-quoted value is parsed. The parser fails to close the heap allocation, leaving a pointer that can be reused, which allows an attacker to trigger a denial of service or, if conditions permit, cause an arbitrary memory write. This flaw reflects a failure to safely handle quoted attributes.

This flaw affects all Red Hat Directory Server releases 11 through 13 as well as the Red Hat Enterprise Linux families 6 through 10, because every version that ships the quoted‑RDN parsing logic in dn.c is vulnerable.

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of < 1% points to a low exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Attacks would require an attacker to supply a specially crafted DN with a legacy‑quoted value, so the likely vector is network‑based client communication to the Directory Server. Denial of service is more reliably observed when heap debugging is enabled, yet the underlying memory corruption could be exploited even when debugging is not active.