CVE-2026-13473

Analyzed Analyzed - Analysis Complete

Heap-based Buffer Overflow in IBM Storage Protect

Publication date: 2026-07-17

Last updated on: 2026-08-11

Assigner: IBM Corporation

Description

IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-08-11

Generated

2026-08-27

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-26

NVD

CVE-2026-13473

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	storage_protect	From 8.1 (inc) to 8.2.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

IBM Storage Protect Client has a heap-based buffer overflow due to improper bounds checking during string copy operations. This allows a remote attacker to overflow a buffer and execute arbitrary code or crash the server.

Detection Guidance

Detection involves checking the installed version of IBM Storage Protect Client. Compare your version against the vulnerable ranges: 8.1.0.0-8.1.27.0, 8.1.27.1, 8.2.0.0-8.2.1.0. Use commands like 'dsmc -version' on Windows or check package managers on Linux.

Impact Analysis

An attacker could exploit this to run malicious code on your system or cause the server to crash, potentially leading to data loss or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data access or loss, which may violate GDPR or HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Upgrade IBM Storage Protect Client to version 8.2.1.2 or later immediately. Apply the fix manually or via Client Auto Deploy. No workarounds are available, so upgrading is the only mitigation.

Hi! I’m here to help you understand CVE-2026-13473. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70