EUVD-2026-95337
GHSA-3q23-fcrr-2gr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Guardium service over network
-
DeliverySend oversized crafted input
-
ExploitOverflow buffer in parser
-
ExecutionCorrupt memory/control flow
-
ImpactExecute arbitrary code on appliance
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are documented - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation against affected IBM Guardium Data Protection 12.0, 12.1, and 12.2 without user interaction. The practical limiting factor is network reachability to the vulnerable Guardium service: these are typically internal database-activity-monitoring appliances, so an attacker needs a foothold on, or routing to, the management/data network rather than open internet access. The description does not name the specific feature, port, or configuration mode carrying the overflow, so no configuration-dependent precondition can be confirmed; exploitation is bounded to the three listed versions and is mitigated by applying IBM's available patch. |
| Impact | Signals are mixed and point to a credible-but-not-yet-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst case: a remote, unauthenticated, low-complexity buffer overflow yielding full C:H/I:H/A:H impact (9.8 Critical), corroborated by SSVC Technical Impact 'total'. However, the demand-side signals are soft: EPSS is only 0.37% (29th percentile), the issue is not on CISA KEV, SSVC Exploitation is 'none', and SSVC Automatable is 'no'. There is no public exploit identified at time of analysis. So while the theoretical severity is maximal, real-world exploitation pressure is currently low and no weaponization is evident - this reads as a patch-promptly item rather than a drop-everything emergency. One caveat worth flagging: the description provides no technical detail on which network-facing component or protocol parser contains the overflow, so the AV:N/PR:N assumptions cannot be independently confirmed against a specific attack surface; Guardium typically sits on managed internal networks, which may constrain exposure in practice. Patch availability from IBM is the decisive mitigating factor. |
| Exploit ScenarioDerived | A remote attacker with network reachability to an IBM Guardium Data Protection appliance (versions 12.0-12.2) sends crafted input to a vulnerable network-facing service, triggering a buffer overflow that corrupts memory and leads to arbitrary code execution on the appliance. No authentication or user interaction is required per the CVSS vector. No public proof-of-concept exists at time of analysis, and the low attack complexity means a working exploit, if developed, would be reliable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
Earlier versions of this analysis (1)
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 via a buffer overflow (CWE-120) in a network-reachable component, and IBM rates the issue CVSS 8.1. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) means an unauthenticated remote attacker requires no credentials and no user interaction, but the high attack complexity indicates that reliable triggering depends on conditions outside the attacker's control, such as a specific memory or heap layout, a race window, or a particular protocol state, which materially lowers realistic exploitability. No public exploit code has been identified at time of analysis and no active exploitation is reported, so this is a serious but not top-tier emergency whose urgency is governed mainly by whether the vulnerable service is reachable from untrusted networks; a vendor fix is available.
RemediationAI
IBM has made a patch available for this issue (patch status: available per vendor advisory) and the fix should be taken from the IBM support page https://www.ibm.com/support/pages/node/7291674; the supplied data does not include an exact fix version or interim-fix identifier, so the specific patched build for each of the 12.0, 12.1, and 12.2 trains must be confirmed against that advisory before scheduling upgrades. Because the vector is AV:N/AC:L/PR:N/UI:N, there is no authentication or user-interaction barrier to lean on, so until appliances are patched the effective compensating control is reachability reduction: restrict access to the Guardium management, collector, and aggregator interfaces with firewall rules, network segmentation, or VPN-only access, allowing only known administrative hosts and approved S-TAP/database collector endpoints - the trade-off is that overly tight rules can break S-TAP agent communication and central policy distribution, so apply them as scoped allowlists rather than blanket blocks. There is no confirmation of the specific vulnerable service or port, so port-level blocking cannot be targeted precisely; instead, monitor for anomalous or oversized traffic on Guardium service interfaces and prioritize patching internet-adjacent or broadly reachable deployments first. Note that exploit code is not publicly available and exploitation has not been observed, so this is a planned-remediation item rather than an emergency, but the 9.8 impact rating justifies keeping the patch cycle short.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-120, a classic buffer overflow: input copied into a fixed-length buffer without adequate bounds checking, producing memory corruption that the advisory states can be leveraged to execute arbitrary code in the Guardium Data Protection context. IBM Guardium Data Protection is a database activity monitoring and data-security platform built from management appliances, collectors, aggregators, and S-TAP inspection components that observe and enforce policy over database traffic; an overflow in one of its network-facing services therefore sits on a high-value control plane. The CPE record cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is version-wildcarded, and neither the description nor the available references identify the specific feature, port, or configuration mode carrying the overflow, so no configuration-dependent precondition can be confirmed beyond the three listed release trains. The SSVC entry marking the attack as non-automatable suggests exploit construction requires some tailoring rather than a spray-and-pray payload, which tempers the 9.8 severity somewhat even though the technical impact is rated total.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes remote unauthenticated buffer-overflow RCE with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as code runs within the appliance.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
Executive ViewAI
A critical remote code execution vulnerability in IBM Guardium Data Protection 12.0, 12.1 and 12.2 could let an unauthenticated attacker seize full control of the appliance the organization depends on to monitor and protect sensitive database activity. Because Guardium is normally deployed on internal management or database-monitoring networks rather than exposed to the internet, and no public exploit code has been identified at time of analysis, the immediate likelihood of attack is limited - but a compromised monitoring platform can be blinded, manipulated, or used as a staging point into database infrastructure. Leadership should care because this is a security control whose failure carries direct audit, regulatory, and data-integrity consequences.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB