IBM Guardium Data Protection: Out-of-bounds read in TDS7 LOGIN7 parser
Summary
IBM Guardium Data Protection 12.0, 12.1 and 12.2 contain a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser, according to IBM's security bulletin the Windows S-TAP component is affected. A remote attacker can send a specially crafted TDS LOGIN7 packet with invalid offset or length values, which may lead to information disclosure or denial of service. No authentication is required, but exploitation depends on whether the TDS listener is reachable from the attacker's network.
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
Component per IBM bulletin: Windows S-TAP. Whether the appliance is also affected is not confirmed.
Fixed in
Unknown. IBM recommends applying the latest IBM Guardium Data Protection Windows S-TAP patch (IBM Fix ID Guardium_12.x.p101_r120203346_S-TAP_Windows). The exact fixed build number is not confirmed in the available sources.
Workaround
- No workaround is listed by IBM (bulletin states "None").
- Pending IBM guidance, restrict access to the TDS listener and S-TAP traffic to known database servers and management networks.
Exploitation
- No evidence of exploitation in the wild was found. CISA SSVC lists exploitation as none and automatable as no.
- No public proof of concept was found.
- EPSS 0.00301 (low predicted exploitation probability).
Our recommendation
- Inventory Guardium Data Protection 12.0 to 12.2 deployments and Windows S-TAP agents.
- Apply IBM's latest Windows S-TAP patch as soon as possible and confirm the exact fixed build in IBM bulletin 7291670.
- Limit network reachability of the TDS listener and S-TAP traffic to required systems, and monitor for malformed TDS LOGIN7 traffic.
- Priority is moderate, rising to high if the service is reachable from user, DMZ or partner networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7291670 www.ibm.com
- Rapid7 record via Vulners vulners.com
- Vulnrichment via Vulners vulners.com
- PT-2026-108173 via Vulners vulners.com
- Strix CVE-2026-82334 www.strix.ai
- OffSeq Radar CVE-2026-82334 radar.offseq.com
- IMFHT intel mirror of IBM bulletin cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:12.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.