CVE-2026-18355: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-18355 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base), caused by an integer underflow in sasl_io_read_packet(). The flaw affects Red Hat's 389-ds-base across multiple product streams including redhat-ds:11, redhat-ds:12, and 389-ds:1.4 on Red Hat Enterprise Linux. It was reported on July 30, 2026 and publicly disclosed on September 7, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is an integer underflow (CWE-191) in the SASL I/O layer. In sasl_io_start_packet(), the 4-byte wrapped-record length read from the wire is validated only against an upper bound (a check introduced for CVE-2026-11774), but not against a lower bound. When an attacker sends a SASL-wrapped record with a wire length of 0, 1, or 2, the computed encrypted_buffer_count (e.g., 4, 5, or 6 after adding sizeof(uint32_t)) falls below the already-consumed encrypted_buffer_offset (7 header bytes). The resulting unsigned subtraction in sasl_io_read_packet() underflows to approximately 0xFFFFFFFD, causing PR_Recv to attempt reading ~4 GiB into a 1024-byte heap buffer — a heap overflow with attacker-controlled content. Exploitation requires a prior successful SASL bind with integrity protection (SSF > 0), making this a post-authentication network attack (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can result in denial of service (server crash) or potentially remote code execution on the affected 389 Directory Server instance. Because 389-ds-base serves as an LDAP directory backend, compromise could expose sensitive directory data including user credentials, group memberships, and organizational information, and could enable lateral movement within environments relying on LDAP for authentication. All three CIA pillars — confidentiality, integrity, and availability — are rated High in the CVSS scoring (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid SASL-authenticated session with integrity protection (SSF > 0), which limits the attacker pool to authenticated users or compromised accounts. The vulnerability was discovered and reported by Adam Korczynski, Arthur Chan, David Korczynski (Ada Logics), and a team from Anthropic (Red Hat CVE, GitHub Advisory).

1. Authenticate via SASL bind: Obtain valid credentials for the 389 Directory Server and perform a SASL bind that negotiates integrity protection (SSF > 0), such as using GSSAPI or DIGEST-MD5 with integrity enabled.
2. Craft a malicious SASL-wrapped record: Construct a SASL-wrapped LDAP message with a wire length prefix of 0, 1, or 2 bytes — values that pass the existing upper-bound check but trigger the lower-bound underflow.
3. Trigger the integer underflow: Send the crafted record to the server. In sasl_io_start_packet(), the small length value causes encrypted_buffer_count to be less than encrypted_buffer_offset, producing an unsigned integer underflow (~0xFFFFFFFD) in sasl_io_read_packet().
4. Cause heap buffer overflow: The underflowed value is passed to PR_Recv, which attempts to read ~4 GiB of attacker-controlled data into the 1024-byte encrypted_buffer heap allocation, overflowing adjacent heap memory.
5. Achieve DoS or RCE: Depending on heap layout and attacker control over the overflow content, the result is either a server crash (DoS) or, with further exploitation of heap metadata, potential remote code execution as the directory server process user (Red Hat CVE, Red Hat Bugzilla).

• Network: Unexpected or malformed LDAP/SASL traffic to port 389 or 636 from authenticated clients; SASL-wrapped records with anomalously small (0–2 byte) length prefixes.
• Logs: 389-ds error logs showing crashes, segmentation faults, or abrupt process termination following SASL-authenticated sessions; repeated SASL bind attempts from a single source.
• Process: Unexpected termination or restart of the ns-slapd process; core dump files generated in the 389-ds working directory following LDAP session activity.
• File System: Presence of core dump files (e.g., core.*) in /var/log/dirsrv/ or the server's working directory indicating a crash event.

Red Hat rates this issue as Important and recommends updating the affected 389-ds-base package as soon as a fix becomes available. No practical configuration-based mitigation has been identified by Red Hat. As a partial risk reduction, administrators can restrict SASL bind access to trusted, known-good accounts and limit network exposure of the LDAP service. Deployments that do not negotiate a SASL security layer (SSF = 0) after bind are not exposed to this specific code path (Red Hat CVE).

The vulnerability was credited to researchers from Ada Logics (Adam Korczynski, Arthur Chan, David Korczynski) and a team from Anthropic, suggesting it may have been discovered through fuzzing or AI-assisted security research. Red Hat has classified the issue as Important severity. No significant broader media coverage or notable community commentary beyond standard CVE tracking sites has been observed as of the disclosure date (Red Hat CVE).