CVE-2026-22185CWE-125CWE-191

OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()

Medium · published January 7, 2026

CVSS v4.0
4.6
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00152 · 4.0th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-01-07T20:26Z
EPSS history
Timeline
  • 07 JAN 20:26Z
    OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()
    cvelistv5