CVE record · CVE-2025-14905

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

CVSS 7.2 HighEPSS 0.013 · 70th percentile

Published by the CVE Program (CNA: redhat) at 23 Feb 2026, 15:41 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Red Hat	Red Hat Directory Server 11.5 E4S for RHEL 8 Package name: redhat-ds:11 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020260303152239.0ca98e7e to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8 Package name: redhat-ds:11 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020260227193008.f969626e to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 11.9 for RHEL 8 Package name: redhat-ds:11 https://access.redhat.com/downloads/content/package-browser/	unaffected 8100020260312105752.37ed7c03 to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 12.2 E4S for RHEL 9 Package name: redhat-ds:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 9020020260304180546.1674d574 to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 12.4 EUS for RHEL 9 Package name: redhat-ds:12 https://access.redhat.com/downloads/content/package-browser/	unaffected 9040020260225135630.1674d574 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 10 Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.3-7.el10_1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.0.6-17.el10_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.3.11.1-11.el7_9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8100020260312103235.25e700aa to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020260303204738.dbc46ba7 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020260303172348.96015a92 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020260303172348.96015a92 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020260303144613.824efc52 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020260303144613.824efc52 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020260303144613.824efc52 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020260227183930.6dbb3803 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: 389-ds:1.4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020260227183930.6dbb3803 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.7.0-10.el9_7 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.0.14-5.el9_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.4-17.el9_2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.4.5-24.el9_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.6.1-20.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 13.1 Package name: dirsrv/dirsrv-container-rhel10 https://catalog.redhat.com/software/containers/	unaffected 1772040913 to before * rpm Other versions: affected
Red Hat	Red Hat Directory Server 12 Package name: redhat-ds:12/389-ds-base https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Directory Server 13 Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: 389-ds-base https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown

Identifiers: CVE-2025-14905
CNA: redhat
Weakness (CWE): CWE-122
Tags: Red Hat Directory Server 11.5 E4S for RHEL 8
Red Hat Directory Server 11.7 E4S for RHEL 8
Red Hat Directory Server 11.9 for RHEL 8
Red Hat Directory Server 12.2 E4S for RHEL 9
Red Hat Directory Server 12.4 EUS for RHEL 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Memory corruption
Published: 23 Feb 2026
Updated: 5 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.2	High	3.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.013, the 70th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

23 Feb 2026, 15:41 UTC Confirmed by the CVE List
23 Feb 2026, 16:29 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2026:3189 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:3208 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:3379 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:3504 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:4207 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:4661 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:4720 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5196 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5511 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5512 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5513 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5514 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5568 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5569 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5576 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5597 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:5598 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:6220 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:6268 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2025-14905 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2423624 issue-trackingredhat

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.