Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-11793 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Redhat 389 Directory Server. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-35423
Vulnerability Data
A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges…
more
can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow (CWE-121) in LDAP server allows privileged Directory Manager to trigger application crash/DoS via oversized algorithm ID in reversible-encrypted attribute.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the identified stack-buffer flaw in checkPrefix() before an attacker can trigger the overflow.
Restricts Directory Manager privileges that are required to store the crafted reversible-encrypted attribute value, eliminating the attack vector for non-privileged users.
Implements memory-protection mechanisms (e.g., FORTIFY_SOURCE-equivalent bounds checks or canaries) that convert the overflow into a non-exploitable denial of service.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent introduction of stack buffer overflows.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Patching eliminates known instances of the weakness after discovery.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing (fuzzing, static analysis) detects stack overflows before release.
Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.
Application security requirements can specify buffer-size and input-validation rules.
Secure architecture principles include memory-safety and least-privilege stack usage.
Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.
Change-management gates can enforce security reviews that catch buffer issues.