CVE-2026-14612— Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any | affected |
| Red Hat | Red Hat Enterprise Linux 6 | any | unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any | affected |
| Red Hat | Red Hat Enterprise Linux 8 | any | affected |
any | affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14612
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
FreeIPA 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
freeipa是freeipa组织开源的一款身份管理解决方案。 FreeIPA存在缓冲区错误漏洞，该漏洞源于FreeIPA ipa-otpd守护进程的OAuth2设备授权处理器中存在两个差一错误，当处理来自配置的外部OAuth2/OIDC身份提供商的超大响应时，可能导致越界内存访问。控制或能中间人攻击IdP端点的攻击者可能触发ipa-otpd在固定大小缓冲区末尾之外写入或读取一个字节，最可能的影响是导致ipa-otpd守护进程受限的拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat Enterprise Linux 7 | - | cpe:/o:redhat:enterprise_linux:7 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 9 | - | cpe:/o:redhat:enterprise_linux:9 |
II. Public POCs for CVE-2026-14612
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14612
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14612 (2)
Same Patch Batch · Red Hat · 2026-07-03 · 6 CVEs total
| CVE-2026-14544 | 9.8 CRITICAL | Hplip: incomplete fix for cve-2026-8631 |
| CVE-2026-58379 | 7.3 HIGH | Gimp: gimp: heap buffer overflow in read_channel_data() |
| CVE-2026-14614 | 5.4 MEDIUM | Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientres |
| CVE-2026-14615 | 4.3 MEDIUM | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child vie |
| CVE-2026-14613 | 4.3 MEDIUM | Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hid |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
- CVE-2026-75032
Bluez: bluez: out-of-bounds read in avrcp parse_media_elemen - CVE-2026-13002
Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap - CVE-2026-58224
Samba: ctdb fails to do integrity checking of received packe - CVE-2026-19617
Libdm: lvm2: libdm: denial of service via uncontrolled recur - CVE-2026-73584
Sblim-sfcb: sblim-sfcb: privileged file corruption and denia
Same vendor: Red Hat
- CVE-2026-66780
Submariner-operator: submariner-operator: flat broker trust - CVE-2026-66783
Submariner-operator: submariner-operator: arbitrary image ov - CVE-2026-66782
Submariner-operator: submariner-operator: broker api bearer - CVE-2026-66781
Submariner-operator: submariner-operator: ipsec psk stored c - CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun
Same weakness: CWE-787
- CVE-2026-67271
Dell PowerStore SDNAS SMB/CIFS越界写入致远程代码执行 - CVE-2026-12553
HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write - CVE-2026-12519
Out-of-bounds stack read and write in Zephyr WNC-M14A2A mode - CVE-2026-12363
Out-of-bounds write in LoRaWAN fragmented transport from a f - CVE-2026-13196
Out-of-bounds Write in KUNBUS piControl
V. Comments for CVE-2026-14612
No comments yet