IBM Guardium Data Protection: Heap-based buffer overflow in MongoDB protocol parser
Summary
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker can send a specially crafted MongoDB SCRAM username with an excessive length to corrupt memory, which may lead to denial of service or arbitrary code execution. No authentication is required, so the risk depends on whether the Guardium component is reachable from untrusted networks. NVD lists CVSS 9.8 (critical), while the IBM bulletin lists 8.1 with a higher attack complexity.
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
- Affected component: Sniffer component, MongoDB protocol parser
Fixed in
Unknown. IBM's bulletin 7291674 recommends the latest Guardium Data Protection Sniffer patch for all affected versions. A third-party source names SqlGuard_12.0p4018_SnifferUpdate, but whether it covers this CVE is unverified.
Workaround
None published by the vendor.
Exploitation
- No confirmed in-the-wild exploitation known at the time of writing.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Guardium Data Protection 12.0 to 12.2 appliances, collectors and sniffer components.
- Ensure Guardium is not reachable from the internet and restrict access to the collector and sniffer interfaces to trusted hosts.
- Check IBM bulletin 7291674 for the exact fix for CVE-2026-82335 and install it as a priority.
- Monitor for exploitation reports, proofs of concept and CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7291674 www.ibm.com
- Rapid7 via Vulners: CVE-2026-82335 vulners.com
- Strix: CVE-2026-82335 www.strix.ai
- Positive Technologies PT-2026-108174 vulners.com
- CVE daily brief digest (CVSS 9.8) github.com
- Action1 vulnerability digest October 2026 www.action1.com
- Safeguard: CVE-2026-84246 Sniffer patch (sibling CVE, same bulletin) safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:25.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.