IBM CVE-2025-64646

The CVSS 3.1 score of 6.2 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a moderate-risk vulnerability with high-confidence factors: local access is required (AV:L) but no privilege elevation or user interaction is needed (PR:N/UI:N), and the confidentiality impact is high (C:H). The lack of integrity or availability impact limits the overall severity. However, CVSS alone may overstate practical risk if Concert is primarily deployed in hardened, single-tenant environments. Without KEV status, active exploitation data, or public POC evidence in the provided intelligence, this appears to be a real but not yet weaponized vulnerability. The availability of a vendor patch and the straightforward attack vector (local memory access) suggest this is a legitimate priority for organizations running Concert in multi-user or less-isolated environments, but may be lower priority for air-gapped or single-user deployments. Organizations should prioritize patching based on their threat model and Concert deployment context.

An unprivileged local user on a system running IBM Concert could attach a debugger or use memory-reading tools (such as gdb, lldb, or custom memory-dumping utilities) to read the application's process memory space. Due to the improper buffer clearing, sensitive data such as authentication tokens, cryptographic keys, or customer information left in freed buffers would remain readable and could be extracted. This requires only local system access with no special privileges or user interaction, making it a viable attack for compromised local accounts or co-resident container processes.