EUVD-2026-85667
GHSA-2vvc-x872-gvjq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low privilege match a foothold-required double free; arbitrary code execution in the process yields full C/I/A within an unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
AnalysisAI
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access to the host trigger a double free (CWE-415) and, with heap grooming, execute arbitrary code in the context of the affected process. Exploitation is authenticated and local only - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) - with full confidentiality, integrity, and availability impact when successful; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires pre-existing local, low-privileged access (AV:L, PR:L) to a host running IBM Concert version 1.0.0 through 3.0.0; the attacker must deliver attacker-influenced input to the vulnerable component and perform heap grooming to convert the double free into reliable code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity flaw requiring existing low-privilege access to the host, yielding full confidentiality, integrity, and availability impact via arbitrary code execution - consistent with a CWE-415 double free that corrupts the heap. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch; IBM lists patch availability for CVE-2026-6794 and directs administrators to https://www.ibm.com/support/pages/node/7288830 for the exact fixed build (patch available per vendor advisory - released patched version not independently confirmed in the provided data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every IBM Concert instance and identify all hosts running a version in the affected range 1.0.0 through 3.0.0, then review local account membership on those hosts to see where low-privileged or shared local access already exists; within 7 days, apply the vendor-released fix referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7288830), upgrading each affected IBM Concert deployment to the corrected release named there - moving off the 1.0.0 through 3.0.0 range entirely - and confirm the resulting build number after service restart; within 30 days, complete the upgrade across all remaining instances including non-production and isolated environments, tighten local account and privilege assignments on Concert hosts to least privilege, validate that process-level monitoring and alerting is active on those systems, and record any instance that cannot be patched in the window with an owner, justification, and compensating restriction.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by dri
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today