IBM Guardium Data Protection: Heap-based buffer overflow in S-TAP
Summary
IBM Guardium Data Protection 12.0, 12.1 and 12.2 is affected by a heap-based buffer overflow in the Windows S-TAP component that processes TDS login packets. An unauthenticated attacker with network access to the S-TAP listener can send crafted TDS login fragments that exceed a fixed-size reassembly buffer. This can lead to denial of service or arbitrary code execution on the monitoring host.
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
Component: Windows S-TAP (according to the IBM bulletin)
Fixed in
Unknown. IBM refers to the Windows S-TAP patch Guardium_12.x.p101_r120203346_S-TAP_Windows for all affected versions. The exact fixed version was not confirmed.
Workaround
Unknown. IBM lists no workaround or mitigation.
- Third-party sources suggest restricting network access to the S-TAP capture path and monitoring for S-TAP crashes or restarts. These are not IBM instructions.
Exploitation
- No known exploitation in the wild at the time of research; no CISA KEV entry found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Check whether Windows S-TAP is deployed, especially on SQL Server hosts, and which versions are running.
- Apply IBM's Windows S-TAP patch as soon as possible and confirm the fixed version on the IBM page.
- Restrict network access to S-TAP to required database and management hosts.
- Monitor for S-TAP crashes or restarts and unusual TDS traffic.
- Scores differ (NVD 9.8, IBM 8.1); plan according to the higher value.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7291670 www.ibm.com
- Vulners: RAPID7 CVE-2026-82344 vulners.com
- Strix: CVE-2026-82344 www.strix.ai
- vuln.management: CVE-2026-82344 vuln.management
- RedPacket Security: CVE-2026-82344 www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:24.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.