Advisory · CVE-2026-82335
Heap buffer overflow in IBM Guardium MongoDB protocol parser
A crafted MongoDB SCRAM username with excessive length can corrupt memory in IBM Guardium Data Protection, risking denial of service or code execution.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-82335
CWE-119 - Action timing
- Immediate
Explain it like I’m five
The inspector copies the username from a MongoDB login into a fixed-size box. A very long username spills over the edges and rewrites whatever was next to the box.
- 01Crafted username
A remote attacker sends a MongoDB SCRAM login with an excessively long username.
- 02Buffer overflow
The parser copies more bytes than the buffer holds, corrupting heap memory.
- 03Crash or control
The service crashes, and crafted input can steer the corruption toward code execution.
What happened
IBM Guardium Data Protection 12.0, 12.1, and 12.2 are vulnerable to a heap-based buffer overflow in the MongoDB protocol parser, according to the IBM security bulletin. A remote attacker can send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution. IBM rates it high at CVSS 8.1.
What to do
- Inventory Guardium Data Protection 12.0 through 12.2 deployments that monitor MongoDB traffic.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict network access to the monitoring interfaces until patched.
- Watch for parser crashes or unusual MongoDB authentication traffic.
Management note
A second memory-safety bug in Guardium’s protocol parsers in the same bulletin batch. If you monitor MongoDB through Guardium, this one is yours to patch.