What is the CVSS score of CVE-2025-64646?

CVE-2025-64646 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2025-64646?

CVE-2025-64646 presents moderate security risk rated CVSS 6.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-64646?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

IBM CVE-2025-64646

EUVD-2025-209031 MEDIUM

Compiler Removal of Code to Clear Buffers (CWE-14)

2026-03-25 ibm

GHSA-6hcp-q563-cm49

Information Disclosure IBM

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 20:47 euvd

EUVD-2025-209031

Analysis Generated

Mar 25, 2026 - 20:47 vuln.today

Patch released

Mar 25, 2026 - 20:47 nvd

Patch available

CVE Published

Mar 25, 2026 - 20:35 nvd

MEDIUM 6.2

DescriptionCVE.org

IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

AnalysisAI

IBM Concert versions 1.0.0 through 2.2.0 suffer from improper buffer resource clearing that allows local attackers to read sensitive information directly from process memory without requiring privileges or user interaction. This information disclosure vulnerability (CVSS 6.2) affects IBM Concert across multiple versions and has a vendor patch available, though no evidence of active exploitation or public proof-of-concept has been reported in the provided intelligence.

Technical ContextAI

The vulnerability is rooted in CWE-14 (Improper Neutralization of Delimiters in Data Structures), which in this case manifests as a buffer memory management flaw. When IBM Concert allocates buffers during normal operations, the application fails to properly zero or clear sensitive data from memory before the buffer is released or reused. This is a classic information disclosure weakness where process memory containing credentials, keys, or other sensitive data remains accessible to an attacker with local system access. The affected product is IBM Concert (cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*), indicating all versions up through 2.2.0 are vulnerable. The local attack vector and lack of privilege requirement suggest this could be exploited by unprivileged local users or processes on the same system.

RemediationAI

Upgrade IBM Concert to version 2.2.1 or later as provided in the vendor patch available at https://www.ibm.com/support/pages/node/7267105. If immediate patching is not feasible, restrict local system access to Concert processes through operating system-level access controls, file system permissions, and user privilege management to limit exposure to unauthorized local users. Additionally, implement process isolation techniques and monitor for suspicious local process memory access patterns using endpoint detection and response (EDR) tools to detect potential exploitation attempts.