CVE-2026-11792

A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.7 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHBA-2025:15534
https://access.redhat.com/security/cve/CVE-2026-11792
https://bugzilla.redhat.com/show_bug.cgi?id=2484915

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad de desbordamiento de búfer de montón en 389 Directory Server. Cuando el registro de auditoría está habilitado, la función create_masked_entry_string() en auditlog.c copia una máscara de contraseña de longitud fija en un búfer de montón de tamaño preciso sin verificar el espacio disponible. Si se registra una contraseña corta en texto claro (que requiere almacenamiento de contraseña CLEAR no predeterminado o un par de replicación comprometido), la copia desborda el búfer, corrompiendo la memoria del montón y la salida del registro de auditoría.

30 Jun 2026, 11:16

Type	Values Removed	Values Added
References	~~{'url': 'https://redhat.atlassian.net/browse/PSIRTSUPT-7600', 'source': 'secalert@redhat.com'}~~

09 Jun 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 14:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-11792

Mitre link : CVE-2026-11792

CVE.ORG link : CVE-2026-11792

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-11792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:35:23.576447Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 0.7}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:directory_server:11"], "vendor": "Red Hat", "product": "Red Hat Directory Server 11", "packageName": "redhat-ds:11/389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:directory_server:12"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12", "packageName": "redhat-ds:12/389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:13"], "vendor": "Red Hat", "product": "Red Hat Directory Server 13", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-09T14:16:37.353", "references": [{"url": "https://access.redhat.com/errata/RHBA-2025:15534", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-11792", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484915", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n en 389 Directory Server. Cuando el registro de auditor\u00eda est\u00e1 habilitado, la funci\u00f3n create_masked_entry_string() en auditlog.c copia una m\u00e1scara de contrase\u00f1a de longitud fija en un b\u00fafer de mont\u00f3n de tama\u00f1o preciso sin verificar el espacio disponible. Si se registra una contrase\u00f1a corta en texto claro (que requiere almacenamiento de contrase\u00f1a CLEAR no predeterminado o un par de replicaci\u00f3n comprometido), la copia desborda el b\u00fafer, corrompiendo la memoria del mont\u00f3n y la salida del registro de auditor\u00eda."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "secalert@redhat.com"}