CVE-2025-14905

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.2EPSS 1%

Published 2026-02-23Updated 2026-02-23

Vulnerability details

A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CNAredhat

EPSS score history

Sources

2 links

PoC links are not available for guest users. Login to view them.

CVE Organization RedHat Vuln DB

Profile

CVSS

7.2

EPSS

Published

2026-02-23

Updated

2026-02-23

CNA

redhat

Vendors

Red Hat

8 products

CPEs

cpe:/a:redhat:directory_server_e4s:11.5::el8

cpe:/a:redhat:directory_server_e4s:11.7::el8

cpe:/a:redhat:directory_server:11.9::el8

cpe:/a:redhat:directory_server_e4s:12.2::el9

cpe:/a:redhat:directory_server_eus:12.4::el9

cpe:/o:redhat:enterprise_linux:10.1

cpe:/o:redhat:enterprise_linux_eus:10.0

cpe:/o:redhat:rhel_els:7

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:rhel_aus:8.2::appstream

cpe:/a:redhat:rhel_aus:8.4::appstream

cpe:/a:redhat:rhel_eus_long_life:8.4::appstream

cpe:/a:redhat:rhel_aus:8.6::appstream

cpe:/a:redhat:rhel_e4s:8.6::appstream

cpe:/a:redhat:rhel_tus:8.6::appstream

cpe:/a:redhat:rhel_e4s:8.8::appstream

cpe:/a:redhat:rhel_tus:8.8::appstream

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:enterprise_linux:9::crb

cpe:/a:redhat:rhel_e4s:9.0::appstream

cpe:/a:redhat:rhel_e4s:9.2::appstream

cpe:/a:redhat:rhel_eus:9.4::appstream

cpe:/a:redhat:rhel_eus:9.4::crb

cpe:/a:redhat:rhel_eus:9.6::appstream

cpe:/a:redhat:rhel_eus:9.6::crb

cpe:/a:redhat:directory_server:13.1::el10

cpe:/a:redhat:directory_server:12

cpe:/a:redhat:directory_server:13

cpe:/o:redhat:enterprise_linux:6

cpe:/o:redhat:rhivos:1

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated