IBM Guardium Data Protection: Buffer overflow in Sniffer component
Summary
A buffer overflow (CWE-120) in the Sniffer component of IBM Guardium Data Protection can allow a remote attacker to execute arbitrary code. No authentication or user interaction is required, but IBM rates attack complexity as high. Successful exploitation would affect confidentiality, integrity and availability of the appliance.
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
- Affected component: Sniffer
Fixed in
- 12.0: Latest IBM Guardium Data Protection Sniffer patch (IBM refers to SqlGuard_12.0p4018_SnifferUpdate; exact build not verified).
- 12.1 and 12.2: Unknown. Check IBM security bulletin 7291674.
Workaround
Unknown. IBM lists no workarounds or mitigations in the bulletin.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV (according to secondary sources).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Open IBM bulletin 7291674 and confirm the fixed build for your exact version.
- Check the Sniffer patch level on all Guardium collectors and aggregators.
- Restrict network access to Guardium appliances and monitored traffic paths until patched.
- Monitor NVD and CISA KEV for changes, and verify the CVSS score (sources differ: 9.8 vs. 8.1).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7291674 www.ibm.com
- Strix: CVE-2026-82895 www.strix.ai
- Vulners (Rapid7): CVE-2026-82895 vulners.com
- OffSeq Radar: CVE-2026-82895 radar.offseq.com
- VulDB: CVE-2026-84246 (sibling entry) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:16.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.