BaseFortify

Publication date: 2025-10-07

Last updated on: 2025-10-16

Assigner: IBM Corporation

Description

IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with access to the files storing CECSUB or CECRM on the container could overflow the buffer and execute arbitrary code on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-07

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36156

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	infosphere_data_replication_vsam_for_z\/os_remote_source	11.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4. It occurs due to improper bounds checking, allowing a local user with access to specific files (CECSUB or CECRM) on the container to overflow the buffer and potentially execute arbitrary code on the system.

Impact Analysis

The vulnerability can allow a local user to execute arbitrary code on the affected system, which can lead to a complete compromise of confidentiality, integrity, and availability of the system and its data.

Hi! I’m here to help you understand CVE-2025-36156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70