Dashboard / CVE-2026-22185

CVE-2026-22185

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 34/100
Published: 2026-01-07 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Active
AT: None
VC: None
VI: None
VA: Low

Description

OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
OpenLDAP Foundation OpenLDAP 0.9.14 < 0.9.34
OpenLDAP Foundation OpenLDAP 0.9.14 < 0.9.34

References & Advisories (5)

https://seclists.org/fulldisclosure/2026/Jan/5
technical-description exploit
https://seclists.org/fulldisclosure/2026/Jan/8
technical-description exploit

Bug Bounty Relevance

34 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.6 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.15%
Raw Score 0.001520
Percentile 4.3%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links