CVE-2026-11786CWE-125

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

Low · published June 9, 2026

CVSS v3.1
1.9
EPSS
0%
Percentile
4.8
In the wild
Unconfirmed
What it is

A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

The record
Technical detail
CVSS v3.1
1.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00160 · 4.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-06-09T12:57Z
EPSS history
Timeline
  • 09 JUN 12:57Z
    389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()
    cvelistv5