EUVD-2026-45307
GHSA-9qhh-4vx4-2pqx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Client-side heap overflow needs attacker-controlled server data or MITM position, so AC:H rather than AC:L; no auth/interaction assumed on the client side, full CIA impact via potential RCE.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
AnalysisAI
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Technical ContextAI
IBM Storage Protect (formerly Tivoli Storage Manager / IBM Spectrum Protect) is enterprise data-protection and backup software; the affected component here is the Storage Protect Client, which communicates with a Storage Protect server to move backup/restore data. The root cause is CWE-122 (heap-based buffer overflow): input is copied into a dynamically allocated heap buffer without adequate bounds checking, allowing an over-long or malformed field to write past the buffer and corrupt adjacent heap metadata or objects. Successful heap corruption of this type can be leveraged for control-flow hijacking (arbitrary code execution) or, more reliably, denial of service via crash. The CPE cpe:2.3:a:ibm:storage_protect:*:*:*:*:*:*:*:* confirms the IBM Storage Protect application as the affected product.
RemediationAI
Patch available per vendor advisory: upgrade the IBM Storage Protect Client to the fixed release referenced in IBM advisory https://www.ibm.com/support/pages/node/7279728 (the exact fixed version is not stated in the available data and should be confirmed directly from that advisory before deployment). Because the affected component is the client and the likely attack path involves malicious data from a server or network position, effective compensating controls until patching include restricting client connectivity so that Storage Protect clients only reach trusted, authenticated backup servers, enforcing TLS with certificate validation on client-server communications to prevent machine-in-the-middle injection, and segmenting the backup network to limit who can present data to clients - the trade-off being added configuration overhead and potential disruption to backup jobs if certificate or routing changes are misapplied. Do not treat absence of an exact version here as absence of a patch; the advisory URL is authoritative.
More in Storage Protect
View allIBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a loca
IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the admi
IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today