IBM Guardium CVE-2026-82344

Exploitation requires an IBM Guardium S-TAP agent (versions 12.0/12.1, and per EUVD possibly 12.2) deployed with the TrafficTap functionality actively inspecting TDS (Tabular Data Stream) protocol traffic - the protocol used by Microsoft SQL Server and Sybase/SAP ASE. The attacker must be able to deliver crafted TDS login fragments into the traffic that the S-TAP agent reassembles, i.e. reach the monitored database-communication path. No authentication or user interaction is required (PR:N/UI:N), so against a reachable, TDS-monitoring S-TAP deployment this is remotely exploitable; the principal limiting factor is network positioning - Guardium S-TAP agents typically monitor internal database traffic, so Internet-facing exploitation is unlikely absent a flat or exposed network, and deployments not monitoring TDS traffic are not exposed to this specific path.

All severity signals point in the same direction for this flaw: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full C:H/I:H/A:H impact, yielding a 9.8 CRITICAL score, and the description explicitly supports this by stating an unauthenticated remote attacker can trigger the heap-based buffer overflow (CWE-119) with crafted TDS login fragments. No EPSS score, SSVC decision data, or CISA KEV entry was provided in the input, and there is no indication of public exploit code, so there is no public exploit identified at time of analysis and no confirmation of active exploitation. The practical risk is tempered by deployment context rather than by the CVSS metrics: the vulnerable code path is the S-TAP TrafficTap TDS login reassembly component, meaning an attacker must be able to reach traffic that the S-TAP agent inspects, which is typically internal database-monitoring infrastructure rather than internet-facing. The net picture is a genuinely high-priority, patch-now issue for IBM Guardium operators because a vendor patch exists and the impact is memory-corruption RCE, but the absence of EPSS/KEV/POC data means imminent mass exploitation is not demonstrated - it should be treated as a serious latent risk pending exploitation telemetry.

An attacker positioned to reach database traffic monitored by an IBM Guardium S-TAP agent sends a sequence of crafted TDS login fragments whose reassembled size exceeds the fixed-size reassembly buffer in the TrafficTap component. Because the flaw is unauthenticated and network-reachable with low complexity (AV:N/AC:L/PR:N), the malformed fragments overflow the heap buffer and either crash the S-TAP agent (denial of service) or lead to arbitrary code execution on the affected host. No public proof-of-concept is identified in the provided data.