CVE-2026-22185
NoneCVSS
—
EPSS
0.2%
Published
Jan 7, 2026
CISA due date
—
The record
OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openldap2_5 | 0 | 2.5.20+11-150500.11.38.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | openldap2_5 | 0 | 2.5.20+11-150500.11.38.1 |
| openSUSE:Leap 15.6 | openldap2_5 | 0 | 2.5.20+11-150500.11.38.1 |
Related vulnerabilities
- CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
- CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
- CVE-2026-112896 Pillow is a Python imaging library. CWE-125
- CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125
- CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name… CWE-125
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-125
- CVE-2026-112020 LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in… CWE-125
- CVE-2026-88842 A flaw was found in BusyBox dpkg. CWE-125