CVE-2026-18355

CVE-2026-18355 is a heap buffer overflow (integer underflow, CWE-191) in the SASL I/O layer of 389 Directory Server (389-ds-base), where sasl_io_start_packet() validates the wrapped-record length read from the wire only against an upper bound. A remote client that has completed a SASL bind with integrity protection (SSF > 0) can declare a very small length (0, 1, or 2), making encrypted_buffer_count smaller than the already-consumed encrypted_buffer_offset; the unsigned subtraction in sasl_io_read_packet() underflows, so PR_Recv is asked to read roughly 4 GiB into a 1024-byte heap buffer. The resulting overflow with attacker-controlled content can crash the directory server (denial of service) or potentially achieve remote code execution. Deployments of 389-ds-base that accept SASL binds with integrity protection are affected; the flaw is distinct from CVE-2026-11774, whose fix only guards against upper-bound overflow and does not address this underflow. No public proof-of-concept, KEV listing, or confirmed exploitation is known; EPSS currently puts the 30-day exploitation probability at 0.8% (56th percentile).

What to do: Apply the 389-ds-base update as soon as your distribution or vendor advisory is available, and confirm the advisory explicitly lists CVE-2026-18355 — the earlier fix for CVE-2026-11774 alone is not sufficient. As interim mitigation, restrict SASL binds that negotiate integrity protection (SSF > 0) and limit LDAP service access to trusted networks, while monitoring for directory server crashes or abnormal connection resets.