CVE-2026-11792 Details

A heap buffer overflow vulnerability has been identified in 389 Directory Server. This issue arises in the audit logging feature, specifically within the create_masked_entry_string() function in auditlog.c. The vulnerability occurs because the function copies a fixed-length password mask into a heap buffer that is precisely sized, without verifying the available space. If a short cleartext password is logged—an occurrence that requires non-default CLEAR password storage or a compromised replication peer—the buffer overflow can corrupt heap memory and disrupt the audit log output.

Users are advised not to use the CLEAR password storage scheme and to disable audit logging if it is not necessary. Additionally, monitor replication agreements for unauthorized peers.