EUVD-2026-85662
GHSA-9rqq-756h-2hmp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description explicitly says a 'local user' triggers the overflow, so AV:L and PR:L; low complexity and arbitrary code execution give AC:L and C:H/I:H/A:H (~7.8), diverging from IBM's AV:N/PR:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
AnalysisAI
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the IBM description, exploitation requires a LOCAL user account on a system running IBM Concert 1.0.0 through 3.0.0 who can pass crafted overlong input to a component lacking proper bounds checking. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This CVE carries a vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which would normally denote a remote, unauthenticated, critical RCE - but the description explicitly states 'A local user could overflow the buffer and execute arbitrary code,' which directly contradicts the network/unauthenticated metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM has published remediation for this issue at https://www.ibm.com/support/pages/node/7288830, and the input data confirms patch availability from the vendor but does not specify an exact fixed version - obtain the version supplied in that advisory from IBM support and upgrade every installation in the 1.0.0-3.0.0 range, since the CPE wildcard shows the flaw is not tied to a single build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running IBM Concert versions 1.0.0 through 3.0.0 and confirm whether any local accounts could be leveraged by an attacker. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by dri
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today