IBM Guardium Data Protection CVE-2026-82334

Exploitation requires network access to the IBM Guardium Data Protection component that parses the TDS7 protocol and reaches the attacker-controllable LOGIN7 handshake path; the attacker must be able to deliver a raw TDS LOGIN7 packet with crafted invalid offset or length fields to that listener. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so default deployments exposing this TDS parser to reachable networks are vulnerable. The primary LIMITING factor is network reachability of the TDS/database-interception listener: environments that segment or firewall Guardium's inspection interfaces away from untrusted networks materially reduce exposure. Affected versions are limited to 12.0, 12.1, and 12.2.

Signals are mixed and point to a lower real-world priority than the 9.1 CVSS score alone suggests. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with high confidentiality and availability impact, which drives the critical score. However, every exploitation-likelihood signal is low: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, no public exploit code is identified, and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (only Technical Impact is rated 'total'). The CVSS C:H/A:H rating also sits in mild tension with the description, which states the flaw 'potentially' causes information disclosure OR denial of service - hedged language typical of a CWE-125 out-of-bounds READ, where disclosure is usually bounded to adjacent heap memory rather than 'total.' Net assessment: a genuine remotely reachable pre-authentication memory-safety bug in enterprise data-security software that warrants patching on a normal prioritized cadence, but current intelligence indicates no active or imminent mass exploitation. Treat the 9.1 as an upper bound pending confirmation of how much memory the OOB read can actually leak.

An attacker with network reachability to the Guardium component that speaks the TDS protocol sends a crafted TDS7 LOGIN7 packet with manipulated offset/length fields, triggering a heap out-of-bounds read in the parser before authentication completes. This either crashes the service (denial of service) or returns adjacent heap memory to the attacker (information disclosure). No public proof-of-concept is currently available, and the attack requires no user interaction or credentials given the AV:N/AC:L/PR:N/UI:N vector.