Advisory · CVE-2026-82334
Out-of-bounds read in IBM Guardium TDS protocol parser
A crafted TDS LOGIN7 packet can trigger a heap out-of-bounds read in IBM Guardium Data Protection, risking information disclosure or denial of service.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-82334
CWE-125 - Action timing
- Immediate
Explain it like I’m five
The inspector reads database login packets by the numbers written in the packet itself. A liar can write a bigger number and make the inspector read someone else's mail.
- 01Crafted packet
A remote attacker sends a TDS LOGIN7 packet with invalid offset or length values.
- 02Out-of-bounds read
The parser reads heap memory beyond the packet buffer.
- 03Disclosure or crash
Adjacent memory contents leak into the response, or the parser crashes.
What happened
IBM Guardium Data Protection 12.0, 12.1, and 12.2 are vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser, according to the IBM security bulletin. A remote attacker can send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service. IBM rates it high at CVSS 8.1.
What to do
- Inventory Guardium Data Protection 12.0 through 12.2 deployments that monitor SQL Server traffic.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict network access to the monitoring interfaces until patched.
- Watch for parser crashes or unusual TDS traffic patterns.
Management note
Protocol parsers on monitoring appliances sit directly in the path of attacker-controlled traffic. A memory-safety bug there is a bug in your sensor, which is the last place you want one.