IBM Concert
CVE-2025-36083
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local authenticated user (AV:L, PR:L) reads residual freed-heap data with no integrity or availability effect; C rated H per vendor though leaked data is opportunistic.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM Concert Software
1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release.
AnalysisAI
Information disclosure in IBM Concert Software 1.0.0 through 2.0.0 allows an authenticated local user to read sensitive data that the application leaves behind in heap buffers it frees without first clearing (CWE-244). Exploitation is confined to the local host and requires low privileges (CVSS 3.1 AV:L/AC:L/PR:L, medium 5.5, confidentiality-only impact), and because the attacker cannot control which residual data happens to remain in freed memory, any leak is opportunistic rather than deterministic. No public exploit code is identified, the issue is not in CISA KEV, and EPSS is negligible at 0.12% (1st percentile), so this rates as a genuinely low-priority finding despite the medium base score.
Technical ContextAI
The root cause class is CWE-244, Improper Clearing of Heap Memory Before Release: a program allocates heap memory to hold sensitive values (credentials, tokens, configuration secrets, or user data), then frees the allocation without overwriting its contents. Because freed heap chunks are typically returned to an allocator's free list rather than zeroed by the operating system, the stale bytes can persist and be re-read - either because they are handed to a subsequent allocation whose contents an attacker can observe, or through a diagnostic/read primitive exposed on the same host. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a local attack path requiring authentication as a low-privileged user, with no user interaction, no integrity or availability impact, and unchanged scope; only confidentiality is affected, but at a High level if a leak succeeds. This is distinct from remote code execution or injection classes: there is no remote or unauthenticated attack path, and the affected software is identified by the broad CPE cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*, which the vendor advisory narrows to IBM Concert Software versions 1.0.0 through 2.0.0.
RemediationAI
No vendor-released patch version is identified in the available data, so the concrete fix level should be taken directly from IBM Support node 7249356 (https://www.ibm.com/support/pages/node/7249356); IBM is the authoritative source for the fixed IBM Concert Software release and any interim guidance. Until a patched build is confirmed, treat local access as the primary control surface: restrict interactive login on IBM Concert hosts to a minimal trusted set of administrators and enforce least-privilege account design so that low-privileged local users (the PR:L prerequisite in the vector) cannot reach the application's memory or diagnostic interfaces. Additional compensating controls include running Concert in isolated containers or dedicated hosts where no untrusted or shared local accounts exist, hardening host-level access controls and auditing of local logons, and eliminating any unnecessary debugging, heap-dump, or crash-report collection features that could surface residual memory contents. The trade-off of tightening local logon and containerizing the service is reduced operational convenience for administrators and potentially added hosting overhead, but because the attack requires an already-authenticated local foothold and is non-deterministic in what it leaks, these measures reduce real-world exposure far more than any attempt to detect the leak itself; there is no meaningful network-level mitigation since the vector is strictly local.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today