EUVD-2026-106859
GHSA-cqc2-7346-rqqh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed QRadar network service
-
DeliverySend malformed crafted request
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent memory or crash service
-
ImpactDenial of service or information disclosure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected versions are IBM QRadar SIEM 7.6.0.0 through 7.6.0.4 and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001; only these ranges are exploitable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required, so any attacker with network reachability to the vulnerable QRadar service can trigger it. The practical limiting factor is network exposure: QRadar consoles/collectors are typically deployed on internal or management networks behind segmentation, so Internet-facing exploitation depends on whether the affected service is actually reachable from the attacker. The description does not name the specific vulnerable feature, service port, or request type, so the exact triggering surface should be confirmed with IBM. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, with high availability impact and low confidentiality impact - consistent with the CWE-125 out-of-bounds read, which can both crash the service (DoS) and leak adjacent memory (information disclosure). However, the high-severity score is driven almost entirely by the availability metric; the confidentiality impact is only Low and there is no integrity impact, so this is not a remote-code-execution-class issue. No EPSS score, SSVC decision, KEV listing, or POC reference was provided in the input, so exploitation probability and automatability cannot be quantified - the only reference is a single IBM support advisory. On balance this is a genuine but second-tier priority: trivial to trigger remotely against a security appliance, yet limited to availability loss plus partial memory disclosure rather than full compromise. EPSS/KEV/POC data is MISSING and should be checked before final prioritization. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to an exposed IBM QRadar SIEM interface that is parsed into an undersized buffer, triggering an out-of-bounds read. This either crashes the processing component (denial of service) or returns adjacent heap/stack memory to the attacker, potentially leaking sensitive data. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4 and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 contains an out-of-bounds read that a network-reachable attacker can trigger without authentication or user interaction. Successful exploitation can crash or degrade the service for a high availability impact and may expose limited adjacent memory, yielding low confidentiality impact; no public exploit has been identified at time of analysis and no KEV status is provided.
RemediationAI
No vendor-released patch identified at time of analysis; consult the IBM advisory at https://www.ibm.com/support/pages/node/7292240 for fixed builds, interim fixes, and update guidance. Until a vendor fix is applied, restrict network reachability to QRadar consoles, collectors, and management interfaces using firewall, ACL, or security-group rules so only trusted administrative networks can access them, accepting the trade-off that remote administration and integrations must be routed through approved access paths. Confirm the exact affected service and port with IBM before tightening rules, and monitor QRadar services for unexpected crashes, restarts, or memory-related errors. Do not expose QRadar management interfaces directly to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds read (CWE-125) in IBM QRadar SIEM, meaning code reads past the bounds of an allocated buffer while handling attacker-influenced input. This memory-safety class can cause a service crash or denial of service and may disclose a limited amount of adjacent process memory. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H vector indicates network reachability, low attack complexity, no privileges or user interaction required, unchanged scope, low confidentiality impact, and high availability impact. The provided data does not identify the specific QRadar feature, service port, or request type that triggers the read, and no CPE strings were supplied, so the exact vulnerable component should be confirmed against IBM's advisory at https://www.ibm.com/support/pages/node/7292240.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Network-reachable unauthenticated OOB read with no user interaction (AV:N/AC:L/PR:N/UI:N); causes service crash (A:H) and partial memory leak (C:L), no integrity impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
Executive ViewAI
IBM QRadar SIEM deployments running 7.6.0.0 through 7.6.0.4 or 7.5.0 Update Package 16 Interim Fix 001 are exposed to a high-severity flaw that can crash or degrade the platform and disrupt security monitoring and incident response. No public exploit identified at time of analysis, but no vendor-released patch has been identified, so affected teams must rely on interim controls until IBM provides a fix. Leadership should prioritize inventorying exposed instances and reducing network exposure to protect continuous security operations.
No vendor-released patch identified at time of analysis; restrict network access to QRadar management interfaces, segment affected appliances, monitor for service crashes or instability, and apply vendor-provided workarounds when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB