Advisory · CVE-2026-82344
Heap overflow in IBM Guardium S-TAP TDS login reassembly
Crafted TDS login fragments can overflow a fixed-size reassembly buffer in IBM Guardium Data Protection, risking denial of service or code execution.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-82344
CWE-119 - Action timing
- Immediate
Explain it like I’m five
The sensor glues login fragments back together on a fixed-size desk. An attacker mails in more fragments than the desk holds, and the overflow lands on whatever is underneath.
- 01Crafted fragments
An unauthenticated remote attacker sends TDS login fragments larger than the fixed reassembly buffer.
- 02Overflow
Reassembly writes past the buffer, corrupting adjacent memory.
- 03Crash or control
The affected system crashes, or crafted fragments steer the corruption toward code execution.
What happened
IBM Guardium Data Protection 12.0, 12.1, and 12.2 are vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality, according to the IBM security bulletin. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution. IBM rates it high at CVSS 8.1.
What to do
- Inventory Guardium Data Protection 12.0 through 12.2 deployments using S-TAP with SQL Server traffic.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict network access to the monitoring interfaces until patched.
- Watch for service crashes or fragmented TDS traffic anomalies.
Management note
This one needs no authentication at all, which moves it to the front of the patch queue for any Guardium deployment exposed to untrusted database clients.