CVE-2026-14612— Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
freeipa是freeipa组织开源的一款身份管理解决方案。 FreeIPA存在缓冲区错误漏洞，该漏洞源于FreeIPA ipa-otpd守护进程的OAuth2设备授权处理器中存在两个差一错误，当处理来自配置的外部OAuth2/OIDC身份提供商的超大响应时，可能导致越界内存访问。控制或能中间人攻击IdP端点的攻击者可能触发ipa-otpd在固定大小缓冲区末尾之外写入或读取一个字节，最可能的影响是导致ipa-otpd守护进程受限的拒绝服务。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14612
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
FreeIPA 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
freeipa是freeipa组织开源的一款身份管理解决方案。 FreeIPA存在缓冲区错误漏洞，该漏洞源于FreeIPA ipa-otpd守护进程的OAuth2设备授权处理器中存在两个差一错误，当处理来自配置的外部OAuth2/OIDC身份提供商的超大响应时，可能导致越界内存访问。控制或能中间人攻击IdP端点的攻击者可能触发ipa-otpd在固定大小缓冲区末尾之外写入或读取一个字节，最可能的影响是导致ipa-otpd守护进程受限的拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-14612
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14612
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14612 (2)
Same Patch Batch · Red Hat · 2026-07-03 · 5 CVEs total
| CVE-2026-58379 | 7.3 HIGH | Gimp: gimp: heap buffer overflow in read_channel_data() |
| CVE-2026-14614 | 5.4 MEDIUM | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientres |
| CVE-2026-14615 | 4.3 MEDIUM | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child vie |
| CVE-2026-14613 | 4.3 MEDIUM | Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hid |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
Same weakness: CWE-787
-
CVE-2026-103628
Chrome<154.0.8037.97 WebGL越界写入漏洞 -
CVE-2026-102514
Out-of-bounds write in PeaZip PEA extractor allows code exec -
CVE-2026-103484
pgvector buffer overflow in IVFFlat index build -
CVE-2026-59685
Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk -
CVE-2026-56449
Apache HTTP Server: mod_proxy_html: crash in dump_content
V. Comments for CVE-2026-14612
No comments yet