IBM Guardium Data Protection: Buffer overflow in Sniffer component

Summary

A buffer overflow (CWE-120) in IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 can be triggered remotely, and IBM states that an attacker could execute arbitrary code. The flaw is in the Sniffer component, which IBM says is affected in all three versions. No authentication is required according to the NVD vector, but IBM's bulletin rates the attack complexity as high (CVSS 8.1), so the exact severity must be confirmed on NVD and in the IBM bulletin.

Affected

• IBM Guardium Data Protection 12.0, 12.1 and 12.2 (Sniffer component)
• CVSS base score: 9.8 in NVD (AC:L) versus 8.1 in the IBM bulletin (AC:H); confirm the vector on NVD

Fixed in

• Latest IBM Guardium Data Protection Sniffer patch for all affected versions; IBM names SqlGuard_12.0p4018_SnifferUpdate in the CVE record
• Per-release fix status: Unknown. Confirm in IBM bulletin 7291674

Workaround

• None. IBM's bulletin lists no workarounds or mitigations; patching is the documented remedy.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public exploit or known exploitation found at the time of research (secondary sources; not verified against CISA KEV).

Our recommendation

• Inventory all Guardium 12.0 to 12.2 systems, including collectors, aggregators and central managers.
• Apply the latest IBM Sniffer patch on every system and verify the installed patch level afterwards.
• Remove any internet exposure and restrict access to Guardium management and Sniffer interfaces to required hosts.
• Patch the whole Sniffer update together, as the same bulletin also covers other Sniffer flaws.
• Re-check NVD, the IBM bulletin and CISA KEV regularly for changes to severity or exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• IBM Security Bulletin 7291674 www.ibm.com
• IBM sniffer patch 12.0p4019 technical note www.ibm.com
• VulDB entry 415644 vuldb.com
• CVE List V5 release 2026-10-10 09:00Z github.com
• Strix CVE summary (CVSS discrepancy) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:14.