IBM Concert EUVD-2026-104533

Exploitation requires local access to a system running IBM Concert (versions 1.0 through 3.0.0) and an existing low-privileged account on that host (PR:L), with no user interaction. The flaw is CWE-244 heap inspection: sensitive data is not cleared from heap memory before release, so an attacker must be positioned to read or dump the application's process memory. High attack complexity (AC:H) further limits exploitation, as success depends on memory layout and timing conditions rather than a simple deterministic trigger. These factors - local-only vector, required authentication, and conditional memory-access timing - substantially constrain realistic exploitation to post-compromise or insider scenarios. No network exposure is involved.

This is a low-priority, high-barrier issue despite the CRITICAL-sounding 'Information Disclosure' label. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) scores only 4.7 (Medium) because, although confidentiality impact is High, exploitation requires local access (AV:L), high attack complexity (AC:H), and existing low-level privileges (PR:L) - three independent limiting factors. CWE-244 (Improper Clearing of Heap Memory Before Release / 'Heap Inspection') means sensitive data such as credentials persists in process heap memory and can be recovered by an attacker able to inspect that memory. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so all exploitation-probability signals are either absent or negative; exploitation would realistically be targeted post-compromise rather than widespread. No signals conflict: the low CVSS, absent EPSS/KEV, and local-only vector all point consistently to low real-world urgency. A vendor patch is available, so remediation is straightforward via normal patch cycles.

An attacker who already has low-privileged local access to a host running IBM Concert dumps or inspects the process heap memory of the application and recovers sensitive data (e.g., credentials or secrets) that was not cleared before memory release. No public exploit code is referenced, and the high attack complexity means reliable extraction depends on timing and memory-layout conditions.