A heap buffer overflow exists in the SASL I/O layer of 389 Directory Server. In the function sasl_io_start_packet(), the wrapped-record length received from the network is only checked against the upper bound. A small length of 0, 1, or 2 causes an unsigned underflow when the encrypted_buffer_count is subtracted from the encrypted_buffer_offset. This permits the code to request a read of roughly 4 GiB into a 1 kB heap buffer, leading to a heap overrun with attacker-controlled data. After a successful SASL bind that includes integrity protection (SSF > 0), a remote authenticated attacker can trigger a denial of service or possibly execute arbitrary code. The flaw is identified as CWE‑191, an integer underflow leading to a heap-based buffer overflow.

Affected products are Red Hat Directory Server versions 11 through 13 and the Red Hat Enterprise Linux operating systems from 6 to 10, 7, 8, and 9. All mentioned versions of the 389-ds-base package host the vulnerable SASL I/O layer and must be evaluated for the presence of the patch.

The vulnerability scores a CVSS of 7.5, indicating high impact. The EPSS score is not available, and it is not listed in CISA’s KEV catalog at this time. Exploitation requires a remote authenticated SASL bind with integrity protection, which limits the attacker to users with valid credentials. Once authenticated, an attacker can press the buffer overrun by sending a crafted SASL packet, leading to denial of service or potentially code execution on the server. Given the need for authentication and the potential for catastrophic impact, the risk is considered significant for exposed directory services.