Guardium Data Protection CVE-2026-84246

The input provides no specific prerequisite feature, protocol, or configuration mode - the one-sentence description only states a remote attacker can trigger a buffer overflow, so the exact vulnerable service and any required deployment mode are UNVERIFIED and should be confirmed with IBM advisory node 7291674. Based solely on the CVSS vector, exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N), but attack complexity is High (AC:H), meaning success depends on conditions outside the attacker's control such as precise memory layout, timing, or a specific non-trivial input path - a meaningful limiting factor that makes reliable, repeatable exploitation harder than the raw 8.1 suggests. Affected deployments are limited to Guardium Data Protection versions 12.0, 12.1, and 12.2; patched builds are not exploitable.

This is a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a remotely reachable, unauthenticated buffer overflow yielding full confidentiality, integrity and availability impact - the hallmark of remote code execution. The one tempering signal inside the CVSS vector is AC:H, meaning exploitation depends on conditions outside the attacker's control (e.g., specific memory state, timing, or non-default input paths), which lowers the effective likelihood of reliable exploitation and accounts for the score landing at 8.1 rather than ~9.8. Critically, several key real-world signals are MISSING from the input: there is no EPSS exploitation-probability score, no SSVC decision data, and no POC indicator supplied, so exploitation likelihood cannot be quantified. This CVE is NOT on the CISA KEV list in the provided data, and no public exploit is referenced. The description is also extremely terse - it names no vulnerable component, protocol, or network service, so the 'remote' reachability claimed by AV:N cannot be independently corroborated against a specific attack surface; verify the affected service/port with IBM. Bottom line: treat as a high-priority patch for a sensitive security appliance, but current evidence points to a theoretically severe flaw without confirmed in-the-wild activity rather than an actively exploited emergency.

A remote, unauthenticated attacker sends specially crafted input to a network-facing Guardium Data Protection service, overflowing a fixed-size buffer (CWE-120) and corrupting memory to hijack execution flow. Because CVSS marks attack complexity as High, the attacker likely needs to win a race or satisfy specific memory/layout conditions, so exploitation may require multiple attempts rather than a single reliable shot. No public exploit code is referenced in the available data.