{"id":"CVE-2026-14612","aliases":["DEBIAN-CVE-2026-14612","EUVD-2026-41554","GHSA-fr6j-mfcv-pgmf","UBUNTU-CVE-2026-14612"],"status":"published","title":"Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00142,"percentile":0.03625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-07-03T15:11:02Z","modified":"2026-11-06T17:54:00Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.1+dfsg1-1+exp1","4.10.1-1+exp1","4.10.2-1","4.10.2-2","4.10.2-2+exp1","4.11.1-1","4.11.1-1+exp1","4.11.1-2","4.11.1-2+exp1","4.11.1-2.1","4.12.2-1","4.12.2-2","4.12.2-3","4.12.4-1","4.12.4-2","4.13.1-1","4.9.11-1","4.9.11-1+exp1","4.9.11-2"]},{"source":"osv","ecosystem":"Debian:13","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.4-1","4.12.4-2","4.13.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-0ubuntu1","3.3.4-0ubuntu1","3.3.4-0ubuntu2","3.3.4-0ubuntu3","3.3.4-0ubuntu3.1","3.3.4-0ubuntu3.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.4-1","4.3.1-0ubuntu1","4.3.1-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4-3ubuntu1","4.4.4-4","4.7.0~pre1+git20180411-2ubuntu1","4.7.0~pre1+git20180411-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-2ubuntu1","4.8.3-1","4.8.6-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.6-1ubuntu6","4.8.6-1ubuntu8","4.8.6-1ubuntu9","4.9.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.2-1","4.10.2-2","4.10.2-2ubuntu3","4.11.1-1","4.11.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-3","4.12.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.1-1","4.13.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freeipa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.4-1","4.12.4-2","4.13.1-1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-14612","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496879","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14612"},{"url":"https://github.com/advisories/GHSA-fr6j-mfcv-pgmf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14612","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14612","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14612","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-14612","title":"Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T15:11:02.173Z","modified":"2026-11-06T17:54:00.624Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-06T18:59:08.498645Z"}],"euvd":[{"id":"EUVD-2026-41554","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T15:11:02Z","modified":"2026-11-06T17:54:00Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-fr6j-mfcv-pgmf","title":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can...","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T18:31:05Z","modified":"2026-07-03T18:31:14Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:13.018027Z"}],"nvd":[{"id":"CVE-2026-14612","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T16:16:54.47Z","modified":"2026-11-06T18:18:06.88Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-06T20:01:12.161832Z"}],"osv":[{"id":"DEBIAN-CVE-2026-14612","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T16:16:54.47Z","modified":"2026-11-07T09:47:35.013948844Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-14612","description":"Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.","status":"published","published":"2026-07-03T16:16:00Z","modified":"2026-10-17T12:58:05.528017338Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"}]}}