EUVD-2026-32497
GHSA-mf5h-x3qw-xr56
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could allow an authenticated user to execute arbitrary code on the system.
AnalysisAI
Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1) arises from a stack-based buffer overflow in the asperahttpd component. An authenticated user with network access can corrupt memory in this HTTP handling component to run code in the context of the service, fully compromising confidentiality, integrity, and availability (CVSS 8.8). No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
IBM Aspera High-Speed Transfer Server (HSTS) and the High-Speed Transfer Endpoint (HSTE) implement Aspera's FASP protocol for accelerated bulk file movement, commonly used for large media and enterprise data transfers. The vulnerable element is asperahttpd, the HTTP daemon Aspera uses to support fallback/HTTP-based transfer and management traffic. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), meaning attacker-controlled input is written past the bounds of a fixed-size buffer on the call stack, allowing adjacent stack memory - including saved return addresses or control structures - to be overwritten, which is the classic precondition for hijacking execution flow. The vendor's own tag set ('RCE, Buffer Overflow, IBM, Stack Overflow') is consistent with this CWE classification.
RemediationAI
Apply the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7273615; because every listed branch up to and including 4.4.7 Fix Pack 1 is affected, the remediation is to upgrade to the vendor's patched Fix Pack/version above 4.4.7 Fix Pack 1 (patch available per vendor advisory - an exact fixed build number was not present in the provided data, so confirm it directly in the IBM advisory before deployment). Until patching is possible, reduce exposure of the asperahttpd HTTP service: restrict network reachability of the asperahttpd port to trusted management hosts via firewall/segmentation, and tighten or disable HTTP/HTTPS fallback transfer if your deployment does not require it (side effect: clients behind restrictive firewalls that rely on HTTP fallback may lose the ability to transfer). Additionally, because exploitation requires authentication, audit and minimize low-privilege Aspera accounts and enforce strong credential hygiene to shrink the pool of accounts that could trigger the overflow (side effect: stricter access may disrupt legitimate automated/service transfer accounts).
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today