CVE-2025-64646
Received Received - Intake
Memory Exposure via Improper Buffer Clearing in IBM Concert

Publication date: 2026-03-25

Last updated on: 2026-03-26

Assigner: IBM Corporation

Description
IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-03-26
Generated
2026-06-16
AI Q&A
2026-03-26
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64646
EUVD
EUVD-2025-209031
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ibm concert From 1.0.0 (inc) to 2.2.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-14 Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in IBM Concert versions 1.0.0 through 2.2.0. It occurs because the software does not properly clear resources in memory, specifically buffers, which could allow an attacker to access sensitive information stored in memory.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive information in memory. This means an attacker with local access could potentially read confidential data that should have been cleared from memory, leading to information disclosure.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart