Guardium Data Protection EUVD-2026-95332

The advisory discloses no specific prerequisite feature, protocol, port, or non-default configuration - it states only that a remote attacker can trigger a stack-based buffer overflow in IBM Guardium Data Protection 12.0-12.2, implying the vulnerable code is reachable in standard deployments. Per the vendor CVSS vector there is no required user interaction or authentication (UI:N/PR:N), but these cannot be verified against description text. Practical limiting factors: exploitation is rated non-automatable by SSVC and no public exploit exists, so reliable code execution likely requires attacker-developed bypass of standard memory protections (stack canaries, ASLR, DEP); exposure is also limited to environments running the three named 12.x versions, and the patch at ibm.com/support/pages/node/7291674 closes the window once applied.

This is a high-severity, pre-patch-priority issue but not an emergency at this moment. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated path to arbitrary code execution with total confidentiality/integrity/availability impact, consistent with the CWE-121 stack-based buffer overflow and the SSVC 'Technical Impact: total' rating - a worst-case profile for a security appliance. However, the real-world exploitation signals are currently cool: EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, SSVC records 'Exploitation: none', and no public exploit code is referenced, so active or imminent mass exploitation is NOT indicated by the data. There is also a tension worth flagging: SSVC marks the flaw 'Automatable: no', which argues against the trivial, scriptable exploitation that AC:L normally implies for a memory-corruption bug - reliable stack-overflow RCE on a hardened appliance often requires defeating protections (ASLR/stack canaries/DEP), so the attacker effort is likely higher than AC:L alone suggests. The description is extremely thin (no attack surface, protocol, or endpoint named) and PR:N is asserted by the vendor without corroborating detail, so the unauthenticated claim cannot be independently verified from the provided inputs. Net: patch promptly because the impact ceiling is total RCE on a data-protection system, but current intelligence points to a not-yet-exploited, non-trivially-automatable issue rather than a widespread drive-by threat.

A remote attacker with network reachability to an IBM Guardium Data Protection appliance (versions 12.0-12.2) sends specially crafted input that overflows a fixed-size stack buffer, overwriting the return address to hijack control flow. With AC:L and no authentication asserted, successful exploitation yields arbitrary code execution and full compromise of a system that monitors and protects sensitive database activity. No public proof-of-concept or exploit code is identified at time of analysis, and SSVC marks the flaw as not automatable, so weaponization would require attacker-developed exploitation work.