Infosphere Data Replication Vsam For Z Os Remote Source
Monthly
Local code execution affects IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4, where improper bounds checking on the files that store the CECSUB or CECRM objects allows a stack-based buffer overflow and arbitrary code execution on the system. The issue carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated local user who can already read and write the container files holding CECSUB or CECRM can trigger it with no user interaction and gain full confidentiality, integrity, and availability impact on the host. It is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified at time of analysis, and the LOCAL vector plus the specialized z/OS mainframe deployment context make this a high-severity but comparatively low-urgency item under real-world triage.
Local code execution affects IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4, where improper bounds checking on the files that store the CECSUB or CECRM objects allows a stack-based buffer overflow and arbitrary code execution on the system. The issue carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated local user who can already read and write the container files holding CECSUB or CECRM can trigger it with no user interaction and gain full confidentiality, integrity, and availability impact on the host. It is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified at time of analysis, and the LOCAL vector plus the specialized z/OS mainframe deployment context make this a high-severity but comparatively low-urgency item under real-world triage.