InfoSphere Data Replication CVE-2025-36156
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access with CECSUB/CECRM file access
-
ExploitWrite oversized data to overflow stack buffer
-
ImpactExecute arbitrary code on z/OS host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local user who already holds access to the container files storing the CECSUB or CECRM objects used by IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4; the attacker overflows a stack buffer there via improper bounds checking to execute code. Limiting factors: the attack vector is LOCAL (AV:L) - not network-reachable despite the 'Remote Source' product name - and it requires pre-existing low-level privileges (PR:L) with access to those specific files, so a remote or wholly unprivileged actor cannot exploit it directly. Exposure is further bounded by the specialized z/OS mainframe deployment context. |
| Impact | This is a high-CVSS (7.8) but comparatively low-urgency issue under real-world triage. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N confirms a LOCAL attack vector requiring an already-authenticated local user (PR:L) with access to the files storing CECSUB or CECRM on the container - it is not remotely exploitable despite the product name containing 'Remote Source' (that refers to a replication component, not the attack vector). Impact is severe once the precondition is met (C:H/I:H/A:H, arbitrary code execution, CWE-119 stack-based buffer overflow). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The combination of local-only access, required prior privileges, and a niche z/OS mainframe product footprint strongly suggests low real-world exploitation likelihood - the primary risk is local privilege escalation / integrity compromise by an actor who already has file access on the host, making this a patch-on-normal-cycle item rather than an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | A local user who already has write access to the container files storing CECSUB or CECRM crafts an oversized or malformed entry that overflows a stack buffer during improper bounds checking, resulting in arbitrary code execution on the z/OS system. No public exploit code is identified at time of analysis, and the attack requires pre-existing local file access rather than remote reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local code execution affects IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4, where improper bounds checking on the files that store the CECSUB or CECRM objects allows a stack-based buffer overflow and arbitrary code execution on the system. The issue carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated local user who can already read and write the container files holding CECSUB or CECRM can trigger it with no user interaction and gain full confidentiality, integrity, and availability impact on the host. It is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified at time of analysis, and the LOCAL vector plus the specialized z/OS mainframe deployment context make this a high-severity but comparatively low-urgency item under real-world triage.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data, and the IBM advisory at https://www.ibm.com/support/pages/node/7247224 should be checked for an APAR, fix pack, or interim fix corresponding to release 11.4 before any upgrade is planned. Until a fix is applied, the most effective compensating control is to tighten filesystem authorization on the directories containing the CECSUB and CECRM container files: grant read/write only to the replication service account, remove group and world permissions, and apply z/OS UNIX ACLs or RACF/ACF2/Top Secret profiles so that ordinary local users cannot supply malformed content - the trade-off is that misconfigured permissions can break replication agents or administrative tooling that currently relies on broader access. Additionally, review and minimize the population of local accounts on the LPAR or container host (PR:L is the only real barrier to exploitation), and monitor or audit writes to the CECSUB/CECRM object files so an attempted overflow is detectable; note that auditing adds I/O overhead on the replication host. Disabling the affected replication subscription is a last-resort option that eliminates exposure but halts change-data-capture processing, so it should be reserved for systems where the file-permission hardening cannot be enforced.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the component of IBM InfoSphere Data Replication VSAM for z/OS Remote Source that parses the container files backing the CECSUB and CECRM objects. Because the code copies data into a fixed-size stack buffer without validating length, a local user with access to those files can write past the buffer boundary, corrupt adjacent stack memory such as saved registers and return addresses, and redirect execution to attacker-supplied code running with the privileges of the affected process. The affected technology is IBM's VSAM-based change-data-capture replication for z/OS, where CECSUB (subscription) and CECRM (remote) definitions are persisted on disk and read by the replication subsystem; the CPE cpe:2.3:a:ibm:infosphere_data_replication_vsam_for_z\/os_remote_source:11.4 confirms version 11.4 is the only affected release listed. Despite the product name containing "Remote Source", the assessed vector is AV:L - the overflow is triggered through local file access, not over the network - and PR:L means the attacker must already hold a valid low-privileged account on the container.
Know when Infosphere Data Replication Vsam For Z Os Remote Source gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires a local user with access to the CECSUB/CECRM container files (AV:L, PR:L), needs no user interaction or special conditions (AC:L, UI:N), and arbitrary code execution yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with access to the files storing CECSUB or CECRM on the container could overflow the buffer and execute arbitrary code on the system.
Executive ViewAI
IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 contains a local privilege-escalation flaw that lets a user who already has read/write access to the CECSUB or CECRM container files overflow a stack buffer and run arbitrary code with full control of the mainframe host. Because these components move and synchronize critical corporate data on z/OS, a successful exploit could corrupt or expose replicated records and disrupt downstream systems that depend on that feed. The exposure is contained to environments where an authenticated insider or compromised service account already holds local file access, but the resulting confidentiality, integrity, and availability impact on the host is total.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and recertify local access to the CECSUB and CECRM container files to only the identities that require it; enforce least privilege and remove unnecessary special/general authority via RACF, ACF2, or Top Secret; enable file-integrity monitoring and alerting on changes to those containers; restrict the affected address space to trusted started tasks and batch jobs; log and review all access attempts; pursue an IBM advisory, APAR, or documented workaround and apply it as soon as available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB