Hitachi HiRDB Server: Stack-based buffer overflow

Summary

A stack-based buffer overflow in Hitachi HiRDB Server allows an attacker to potentially execute code remotely. The flaw affects HiRDB Server Version 10 before 10-12-01, as well as Version 9 and 9(32) builds in the listed ranges, including the variants with Additional Function. According to the CVSS vector, exploitation requires no privileges and no user interaction, but the attacker must be able to reach the HiRDB service over the network. No exploitation has been reported so far, and the exploit status is not confirmed by the vendor.

Affected

• HiRDB Server Version 10: 10-00 before 10-12-01 (all platforms listed by Hitachi)
• HiRDB Server Version 9: 09-00 through 09-66-22
• HiRDB Server with Additional Function Version 9: 09-00 through 09-66-/V
• HiRDB Server Version 9(32): 09-02 through 09-66-22
• HiRDB Server with Additional Function Version 9(32): 09-00 through 09-66-/V
• Exact version ranges to be confirmed in the Hitachi advisory.

Fixed in

• HiRDB Server Version 10: 10-12-01 (also 10-11-02 and 10-08-05 listed by Hitachi for other branches)
• HiRDB Server Version 9 and 9(32): Unknown.

Workaround

Unknown. No vendor workaround was found.

Exploitation

• No public exploit or proof of concept was found.
• Not known to be exploited in the wild.
• Not listed in CISA KEV at the time of research.
• EPSS: 0.52 % (percentile 44).

Our recommendation

• Check whether any HiRDB Server instance exists in your environment or at customers.
• Upgrade HiRDB Server Version 10 to 10-12-01 or later.
• For Version 9 and 9(32), where no fix is confirmed, restrict network access to the HiRDB port and isolate the server until Hitachi confirms a fix.
• Make sure the HiRDB port is not reachable from the internet, including via remote-support or VPN paths.
• Review the full Hitachi advisory, as related CVEs (CVE-2026-82116, 82117, 82119, 82120, 82122) were published at the same time.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi Security Information hitachi-sec-2026-147 www.hitachi.com
• VulDB CVE-2026-82118 vuldb.com
• Strix CVE-2026-82118 www.strix.ai
• Offseq CVE-2026-82118 radar.offseq.com
• CVE Brief archive 2026/10/28 cvebrief.com
• Hitachi HiRDB product page www.hitachi.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:30.