Memory Exposure via Improper Buffer Clearing in IBM Concert

Publication date: 2026-03-25

Last updated on: 2026-03-26

Assigner: IBM Corporation

Description

IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-03-26

Generated

2026-07-06

AI Q&A

2026-03-26

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64646

EUVD

EUVD-2025-209031

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	concert	From 1.0.0 (inc) to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-14	Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

Attack-Flow Graph

Executive Summary

This vulnerability exists in IBM Concert versions 1.0.0 through 2.2.0. It occurs because the software does not properly clear resources in memory, specifically buffers, which could allow an attacker to access sensitive information stored in memory.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive information in memory. This means an attacker with local access could potentially read confidential data that should have been cleared from memory, leading to information disclosure.

Hi! I’m here to help you understand CVE-2025-64646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70