EUVD-2026-95164
GHSA-3m7g-89m5-5fvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged local access on Guardium host
-
ExploitCraft malicious METHOD_NEITHER IOCTL with user-controlled pointer
-
ExecutionDereference unvalidated pointer in WfpMonitor driver
-
ImpactCrash kernel or leak limited kernel memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local, already-privileged access (PR:H) on a Windows host running the IBM Guardium Data Protection agent, plus the ability to issue DeviceIoControl calls to the WfpMonitor kernel driver using METHOD_NEITHER IOCTL codes with attacker-chosen pointers. Limiting factors: no remote vector (local only), the attacker must already possess high privileges so this grants no privilege escalation, no user interaction is needed, and impact is bounded to denial of service (system crash) and limited kernel-memory reads - there is no integrity impact and no code execution is described. |
| Impact | This is a moderate-to-low real-world priority despite being a kernel-driver flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H, base 5.1) requires local access AND high privileges (PR:H), meaning the attacker must already be an administrator/privileged user before exploitation - this substantially caps the escalation value, since the primary outcomes are a system crash (A:H) and limited kernel-memory reads (C:L) rather than privilege gain (I:N). Exploitation status is 'no public exploit identified at time of analysis': the input contains no KEV listing and no POC flag. EPSS exploitation-probability data is NOT provided in the input, so probabilistic exploitation likelihood cannot be assessed - this is a data gap. No SSVC decision data is provided either. The signals are internally consistent (vendor-reported by IBM, patch available, local/privileged vector), with no conflicts between CVSS and the description. Bottom line: a legitimately medium-severity local DoS / limited-infoleak issue in a defensive security product, not an urgent remote threat; patch on a normal cycle unless Guardium hosts are multi-tenant or run untrusted local workloads. |
| Exploit ScenarioDerived | A local attacker who already holds high privileges on a Windows host running the Guardium Data Protection agent sends a crafted METHOD_NEITHER IOCTL to the WfpMonitor kernel driver, supplying a malicious user-controlled pointer. Because the driver dereferences the pointer without adequate probing or exception handling, the result is a kernel crash (bugcheck/BSOD) or disclosure of limited kernel memory. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
IBM Guardium Data Protection 12.0, 12.1 and 12.2 ship the WfpMonitor kernel driver, whose METHOD_NEITHER IOCTL handlers dereference caller-supplied pointers without consistent probing or exception handling, so a local attacker who already holds high privileges on the host can trigger a system crash or obtain limited reads of kernel memory. The CVSS 3.1 vector (AV:L/PR:H/UI:N, C:L/I:N/A:H, score 5.1) confirms the flaw is local-only and requires pre-existing elevated privileges, meaning it grants no privilege escalation and has no integrity or code-execution impact. There is no CISA KEV entry and no public exploit code identified at time of analysis, and a vendor patch is available, making this a moderate-to-low real-world priority that is best handled through routine driver patching.
RemediationAI
Apply the vendor fix from IBM Support node 7291676 (https://www.ibm.com/support/pages/node/7291676), which is the patch reference for CVE-2026-84290 - an exact fixed driver version is not specified in the available data, so confirm the applicable build against the advisory before closing the item; note that patching the WfpMonitor driver requires a host or appliance restart or driver reload, which will briefly interrupt Guardium monitoring on that node. If patching must be deferred, the exposure is limited to already-privileged local users, so the highest-value compensating controls are tightening who holds administrative rights on Guardium-managed Windows hosts (reduce local admin membership, enforce just-in-time elevation) and auditing for unexpected SYSTEM-level bugchecks or unusual DeviceIoControl traffic to the WfpMonitor device handle, at the cost of increased operational friction for legitimate administrators. Restricting or removing the driver outright, or tightening the DACL on its device object so only the specific service account can open it, eliminates the attack surface but will disable the Guardium network-filtering/WFP monitoring function on that host and therefore should only be used as a temporary measure on non-critical nodes. There is no integrity or code-execution impact described, so the residual risk of delaying the patch is a local denial-of-service and a limited kernel-memory disclosure, not host compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is WfpMonitor, a kernel-mode driver shipped with the IBM Guardium Data Protection agent on Windows hosts, which exposes a device object that user-mode components communicate with via DeviceIoControl. Several of its IOCTL handlers are declared with the METHOD_NEITHER transfer type, which means the I/O manager does not validate, lock, or copy the caller's input/output buffers and instead passes raw user-mode virtual addresses straight into the driver. Correct handling of METHOD_NEITHER requires the driver to wrap every dereference in ProbeForRead/ProbeForWrite against the caller's address range and to guard the access with structured exception handling (SEH, __try/__except), because the addresses can point anywhere - unmapped memory, kernel space, or paged-out regions. Here that validation is missing or incomplete, so a crafted IOCTL request can drive the driver into dereferencing attacker-chosen addresses, producing a bugcheck (system crash) or leaking small amounts of kernel memory back through the I/O buffer. This behaviour falls under CWE-119, improper restriction of operations within the bounds of a memory buffer, a class that in METHOD_NEITHER drivers typically manifests as unvalidated pointer dereference rather than a classic stack or heap overflow. The affected CPE, cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*, is scoped across the 12.0, 12.1 and 12.2 release trains, and the CVSS vector PR:H plus AV:L underscores that the attacker must already be an administrator or otherwise privileged local user with the ability to open the driver's device handle and issue raw IOCTLs.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Local IOCTL interaction (AV:L) by an already-privileged user (PR:H) reliably triggers the flaw (AC:L); impact is system crash (A:H) and limited kernel reads (C:L), no integrity effect (I:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB