{"id":"CVE-2026-84058","published":"2026-10-08T22:17:33.313","lastModified":"2026-10-14T20:28:15.160","description":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-119"],"vendors":["ibm"],"products":["guardium data protection"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291674","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overrun vulnerability in IBM Guardium Data Protection's TDS PRELOGIN packet decoder allows remote attackers to cause denial of service or potentially execute arbitrary code on the Collector appliance when processing specially crafted SQL Server connection packets.","exploitability":"Exploitation requires sending a malformed TDS PRELOGIN packet to a Guardium Collector, which is moderately difficult without prior access but possible for external attackers who can reach the collector's network monitoring ports.","blast_radius":"If exploited, this vulnerability could disrupt data protection monitoring capabilities across the enterprise, potentially allowing attackers to gain control of critical data security infrastructure and compromise sensitive data flows.","remediation":"Upgrade to IBM Guardium Data Protection 12.2.1 or later to address this buffer overrun vulnerability.","detection":"Monitor for异常的TDS PRELOGIN packet处理日志或网络流量模式，特别是来自非标准SQL Server客户端的连接尝试。如果需要更具体的检测，可以查看Guardium Collector的日志文件中与TDS协议解析相关的错误信息。","tags":["rce","dos","network"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:18:47.660Z"}}