Guardium Data Protection EUVD-2026-95247

Exploitation requires that Guardium's MongoDB protocol inspection engine actively parse the attacker-supplied traffic - i.e., Guardium (via its S-TAP/collector) must be configured to monitor MongoDB database traffic and process the SCRAM authentication handshake. The concrete trigger is a MongoDB SCRAM authentication message whose username field is of excessive length, overflowing the heap buffer in the parser. Per the CVSS vector (PR:N/UI:N), no authentication to Guardium and no user interaction are required, and the attack is remote. The principal limiting factor is deployment-specific: the flaw is only reachable in environments where Guardium is deployed and is monitoring MongoDB traffic on the affected 12.0/12.1/12.2 versions; environments not inspecting MongoDB are not exposed via this path. Reliable arbitrary code execution (versus a DoS crash) is further limited by heap-exploitation difficulty.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a remote, low-complexity, pre-authentication memory-corruption flaw with full confidentiality, integrity, and availability impact - on paper a top-tier priority. However, the real-world risk is more nuanced than the raw 9.8 suggests. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The CWE-119/heap-based buffer overflow means that while a denial-of-service outcome is readily achievable by sending an oversized SCRAM username, reliable arbitrary code execution requires defeating modern heap and memory-protection mitigations, which is non-trivial - the description itself hedges with 'potentially resulting in ... arbitrary code execution.' A key contextual caveat: although the vector is AV:N/PR:N, exploitation is not against an arbitrary internet service but specifically against Guardium's MongoDB protocol inspection path, which only processes this input when Guardium is actively monitoring MongoDB traffic. The combination of 'network/unauthenticated' CVSS but no EPSS, no KEV, and no POC suggests a genuinely severe but not-yet-weaponized issue: patch promptly given the critical rating and vendor-confirmed fix, but there is no current evidence of active or widespread exploitation.

An attacker with network reach to a MongoDB instance (or path) monitored by Guardium initiates a MongoDB SCRAM authentication handshake and supplies a username field of excessive length. Guardium's MongoDB protocol parser copies this oversized username into an undersized heap buffer, corrupting adjacent memory and causing at minimum a crash (DoS) of the inspection engine, and potentially arbitrary code execution. No public exploit code is identified at time of analysis, and the attack does not require authentication to Guardium itself.