CVE-2025-14905 389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
Affected products: vendor: Red Hat
product: Red Hat Directory Server 11.5 E4S for RHEL 8
cpes: cpe:/a:redhat:directory_server_e4s:11.5::el8
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 11.7 E4S for RHEL 8
cpes: cpe:/a:redhat:directory_server_e4s:11.7::el8
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 11.9 for RHEL 8
cpes: cpe:/a:redhat:directory_server:11.9::el8
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 12.2 E4S for RHEL 9
cpes: cpe:/a:redhat:directory_server_e4s:12.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 12.4 EUS for RHEL 9
cpes: cpe:/a:redhat:directory_server_eus:12.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10.0 Extended Update Support
cpes: cpe:/o:redhat:enterprise_linux_eus:10.0
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7 Extended Lifecycle Support
cpes: cpe:/o:redhat:rhel_els:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_aus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.4::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.6 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/a:redhat:rhel_eus:9.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 13.1
cpes: cpe:/a:redhat:directory_server:13.1::el10
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 12
cpes: cpe:/a:redhat:directory_server:12
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 13
cpes: cpe:/a:redhat:directory_server:13
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Red Hat Security Research Team (Red Hat Inc.).
Published: 2026-02-23T15:41:47.976Z