CVE-2026-82335
Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in IBM Guardium Data Protection

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: IBM Corporation

Description
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-82335
EUVD
EUVD-2026-95247

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
IBM Guardium Data Protection 12.0
IBM Guardium Data Protection 12.1
IBM Guardium Data Protection 12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82335 is a heap-based buffer overflow in IBM Guardium Data Protection's MongoDB protocol parser. A remote attacker can send a specially crafted MongoDB SCRAM username with an excessive length, causing memory corruption. This may lead to denial of service or arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual MongoDB SCRAM authentication attempts with excessively long usernames. Inspect network traffic for malformed MongoDB protocol messages targeting Guardium Data Protection systems. Check Guardium logs for authentication failures or memory corruption errors related to MongoDB parsing.

Impact Analysis

This vulnerability could allow an attacker to crash the system (denial of service) or execute arbitrary code on affected IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. It may compromise data integrity, confidentiality, or system availability if exploited.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or data exfiltration due to arbitrary code execution or denial of service, which may violate data protection requirements under GDPR and HIPAA. Unauthorized access to sensitive data could result in compliance breaches, regulatory penalties, or loss of protected health information integrity.

Mitigation Strategies

Apply the latest Sniffer patch provided by IBM for Guardium Data Protection versions 12.0, 12.1, and 12.2. Isolate affected systems from untrusted networks until patched. Monitor for exploitation attempts and restrict MongoDB protocol access to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart