EUVD-2026-45307
GHSA-9qhh-4vx4-2pqx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but reliable heap-overflow RCE needs grooming so AC:H; full code execution gives C:H/I:H/A:H with no scope change.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
AnalysisAI
Remote arbitrary code execution in the IBM Storage Protect (formerly Spectrum Protect / Tivoli Storage Manager) Client affects versions 8.1.0.0 through 8.1.27.1 and 8.2.0.0 through 8.2.1.0, where improper bounds checking allows a heap-based buffer overflow that can execute code or crash the affected component. The flaw was reported by IBM's own PSIRT and carries a CVSS 8.1 (High) rating with an unauthenticated network vector but high attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to deliver crafted malformed data that reaches the vulnerable bounds-checking code path in the IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 or 8.2.0.0-8.2.1.0) - in practice, the ability to act as, spoof, or intercept the peer the client parses data from. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1 High) indicates a network-reachable, unauthenticated flaw with full CIA impact but high attack complexity, which tempers real-world exploitability - heap overflows against modern ASLR/DEP-hardened binaries typically require reliable memory grooming and information leaks, consistent with the AC:H rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned to feed data to a vulnerable Storage Protect Client - for example a compromised or spoofed backup server, or a man-in-the-middle on unencrypted client-server traffic - sends a crafted response that violates the client's bounds checking and overflows a heap buffer. Given the high attack complexity, the attacker must reliably groom the heap to convert the overflow into control-flow hijack and arbitrary code execution, or settle for a denial-of-service crash of the component. … |
| Remediation | Patch available per vendor advisory - consult the IBM Security Bulletin at https://www.ibm.com/support/pages/node/7279728 and upgrade the IBM Storage Protect Client to the vendor-designated fixed level above the affected 8.1.27.1 and 8.2.1.0 ranges (the input does not include an exact fixed version, so obtain it from the bulletin rather than assuming one). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all deployed IBM Storage Protect client versions (8.1.x and 8.2.x) and identify systems exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today