Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:HSummary
CVE-2026-11791 is a medium-severity Use After Free (CWE-416) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-5 (Access Restrictions for Change) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-37902
Vulnerability Data
A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent…
more
LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free flaw in directory server directly enables application exploitation to trigger DoS crash (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Restricts which principals may invoke schema reload, directly blocking the concurrent reload + query scenario that triggers the unconditional free in attr_syntax_swap_ht().
Limits administrator accounts to the minimal set of privileges needed for schema changes, reducing the chance an authorized reload occurs while LDAP worker threads hold references.
Monitors directory-server processes and memory-error indicators, enabling detection of the resulting use-after-free crash before widespread denial of service.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly incorporate memory-safety tooling and reviews that prevent most use-after-free defects.
Vulnerability identification processes can discover use-after-free issues via scanning or analysis but do not prevent their introduction.
Routine patching removes known use-after-free instances after they have been introduced in released software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect use-after-free bugs before release.
Secure SDLC mandates memory-safety practices that reduce use-after-free defects.
Application security requirements can specify memory-management rules that mitigate use-after-free.
Secure architecture principles include memory-safety design choices that limit use-after-free exposure.
Secure coding standards directly prescribe avoidance of use-after-free patterns.
Change-management processes help ensure memory-safety fixes are deployed consistently.