CVE-2026-11786CWE-125
389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()
Low · published June 9, 2026
What it is
A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.
The record
Technical detail
- CVSS v3.1
- 1.9 · LOW
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00160 · 4.8th percentile
- Weakness
- CWE-125 · Out-of-bounds Read
- Published
- 2026-06-09T12:57Z
EPSS history
Timeline