IBM Concert CVE-2025-1721

The attacker must be able to reach an IBM Concert (versions 1.0.0 through 2.1.0) interface that returns server-side responses derived from heap memory; the flaw is residual-data exposure from improper clearing of heap memory before release (CWE-244), so disclosure is opportunistic and non-deterministic rather than attacker-directed. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once the interface is reachable, but the description does not name the specific feature, protocol, or endpoint that returns the leaked memory, and exploitation is limited by the attacker's inability to control which heap contents are exposed and by whatever network exposure controls (internal-only deployment, access restrictions) the operator has in place.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, unauthenticated, low-complexity confidentiality-only flaw, which on paper reads as high priority. However, the supporting exploitation signals do not reinforce that: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - the only reference is the IBM vendor advisory. No SSVC decision data (automatable, technical impact, exploitation status) was supplied. The underlying weakness (CWE-244, improper clearing of heap memory before release) typically yields residual, non-deterministic memory fragments rather than attacker-chosen data, so real-world value to an attacker is often lower than the C:H rating and 7.5 score imply. Net: this is a vendor-reported, confidentiality-only issue in a niche IBM product with no evidence of exploitation or tooling, so it is best treated as a patch-in-normal-cycle item rather than an emergency, while acknowledging the network/unauthenticated vector means it should not be ignored. Conflict to verify with IBM: the AV:N/PR:N rating is not explained by the terse description, which does not state the protocol, endpoint, or authentication context through which leaked memory is returned to a remote attacker.

A remote attacker repeatedly interacts with an exposed IBM Concert interface and receives responses that include uncleared heap memory left over from prior processing, gradually harvesting fragments such as credentials, tokens, or other sensitive runtime data. No public exploit code is identified, and because the leaked content is residual heap data the attacker cannot precisely choose what is disclosed. Given AV:N/AC:L/PR:N/UI:N, the interaction itself requires no authentication or user interaction once the interface is reachable.