CVE-2026-103547

CriticalCVSS 9.2/10Last modified Oct 1, 2026

Description

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

Metrics

CVSS 4.0 9.2/10CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Oct 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1035485.3Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gainCVE-2026-1035492.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 thCVE-2026-1035527.3Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflowsCVE-2026-1035537.8Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1035547.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1035557.0Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1035587.5Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.CVE-2026-1035605.5Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-1035657.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1035675.5Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.CVE-2026-1035687.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorCVE-2026-1035697.5Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.