IBM Guardium Data Protection: Buffer overflow in TDS PRELOGIN packet decoder
Summary
IBM Guardium Data Protection contains a buffer overflow in the decoder for TDS (Microsoft SQL Server) PRELOGIN packets in the Sniffer component. A remote attacker who can send a crafted PRELOGIN packet to a network monitored by a Guardium Collector can cause a denial of service or possibly execute arbitrary code on the appliance. No credentials are required, but the attacker needs network access to the monitored traffic. IBM's bulletin rates the issue 8.1 (AC:H), while the NVD record rates it 9.8 (AC:L).
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
- Component: Sniffer (TDS PRELOGIN decoder)
Fixed in
Unknown. IBM recommends applying the latest IBM Guardium Data Protection Sniffer patch for all affected versions. The specific fixed patch level for this CVE was not confirmed in the sources.
Workaround
- IBM lists no workaround or mitigation.
- Restrict which hosts can send traffic into monitored network segments.
- Keep collectors on management networks, not internet-facing.
Exploitation
- No public proof-of-concept found.
- Not listed as known exploited (KEV) in the sources checked; the snapshot may be outdated.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all Guardium Collectors and Sniffer versions.
- Apply the latest IBM Sniffer patch to all affected systems and confirm the patch level for this CVE with IBM.
- Limit network access to the collectors and monitored segments.
- Monitor collectors for crashes, restarts and malformed TDS traffic.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: Multiple vulnerabilities affect the Sniffer component www.ibm.com
- Rapid7 Vulners: CVE-2026-84058 vulners.com
- Strix: CVE-2026-84058 www.strix.ai
- CVE-2026-84058 (imfht intel) cve.imfht.com
- OffSeq Radar: CVE-2026-84058 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:12.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.