CVE-2026-12528

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description A flaw exists in the aclp normalize acltxt() function within aclparse.c. A malformed Access Control Instruction (ACI) string can trigger heap-buffer-overflow writes and reads during parsing. This occurs because the function does not validate if the ACI keyword has sufficient length after whitespace stripping, resulting in a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute can send a crafted ACI value to corrupt heap memory in the directory server process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.