HiRDB Server CVE-2026-82120

The available sources do not state a specific triggering feature, protocol, or configuration mode - the description reads only 'Heap-based Buffer Overflow Vulnerability in HiRDB,' so the exact prerequisite input is not described. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is characterized as remote, low-complexity, with no authentication or user interaction against affected HiRDB Server builds. Limiting factors: exploitation requires network reachability of the HiRDB Server process (typically an internal/back-end database tier rather than an internet-facing service, which narrows real-world exposure), and only the listed version ranges are affected - HiRDB Server Version 10 (10-00 before 10-12-01), HiRDB Server Version 9 and the Additional Function / (32) variants (09-00 through 09-66-22 / 09-66/V as listed). Whether reaching the vulnerable code path in practice needs an established client connection or session is not confirmed by the available data.

Signals are mixed but lean toward prioritization. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and the vuln.today Decision label is 'act_now' with a vendor patch already available - these argue for urgent remediation. Counterbalancing this, the EPSS score is low (0.52%, 44th percentile), indicating no statistical signal of imminent mass exploitation, and the CVE is NOT on CISA KEV, with no public exploit or PoC reference supplied. So the picture is a maximum-severity, easily-exploitable-on-paper vulnerability in a database server that is not yet observed being exploited. The tension to flag explicitly: the CVSS vector asserts PR:N (unauthenticated), yet the description gives no trigger detail at all, and HiRDB is a database server where reaching the vulnerable code path may in practice require a connection or authenticated session - this cannot be confirmed from the available data and should be verified against the Hitachi advisory (hitachi-sec-2026-147). Net: treat as a real high priority for patching per the vendor and the act_now label, while recognizing the low EPSS suggests exploitation is not currently widespread.

A remote attacker reaches an exposed HiRDB Server instance and submits crafted input that overflows a heap buffer (CWE-122) in the server process, corrupting heap memory to achieve remote code execution with full confidentiality, integrity, and availability impact. The specific triggering request or protocol field is not described in the available sources. No public exploit or PoC has been identified at time of analysis.