IBM Concert CVE-2025-12771

Exploitation requires a local, authenticated account on a host running IBM Concert versions 1.0.0 through 2.1.0 (per CVSS AV:L and PR:L) - there is no remote or network-facing attack path. The attacker must be able to supply crafted, oversized input to the component that performs improper bounds checking; no user interaction by a victim is required (UI:N). Limiting factors: the local-only vector means the attacker must already have host access, and the PR:L requirement means an unauthenticated or purely external attacker cannot trigger it directly, confining realistic risk to multi-user systems, shared hosts, or chained post-access scenarios. The specific vulnerable feature/parameter is not named in the available description.

This is a locally-exploitable stack-based buffer overflow (CVSS 3.1 base 7.8) in IBM Concert. The provided vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector (AV:L) with low attack complexity (AC:L) requiring low-level privileges (PR:L, i.e. an authenticated local user) and no user interaction, yielding high confidentiality, integrity and availability impact within an unchanged scope. The description ("A local user could overflow the buffer and execute arbitrary code") is fully consistent with this vector - there is no network-reachable path, so this is a privilege-escalation / local code-execution issue rather than a remotely wormable flaw. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis; exploitation probability signals are entirely absent rather than low. Net assessment: this is a genuine high-severity local flaw worth patching on multi-user or shared IBM Concert hosts, but the local-only vector and authentication requirement substantially cap real-world urgency compared with a network-facing RCE. Absent EPSS/KEV/POC data, treat prioritization as medium-high and driven by the local attacker model, not by evidence of active exploitation.

An authenticated local user with low privileges on a system running IBM Concert supplies overly long input to a vulnerable routine that performs improper bounds checking, overflowing a stack buffer and overwriting control data to execute arbitrary code - potentially at the privilege level of the Concert process. No public proof-of-concept is identified in the supplied data, and because the attack vector is local (AV:L), the attacker must already have access to the host.