CVE-2026-12091: CWE-125 Out-of-bounds Read in IBM Security Verify Access
Description
CVE-2026-12091 is a low severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows a remote attacker to cause a denial of service via a heap-based out-of-bounds read. The affected versions are 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability involves a specially crafted request triggering a limited out-of-bounds memory read.
CVSS v3.1
Score 3.7low
Affected software
IBM
Security Verify Access
IBM
Verify Identity Access
IBM
Security Verify Access Container
IBM
Verify Identity Access Container
pkg:rpm/ibm/security_verify_accesspkg:rpm/ibm/verify_identity_accesscpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:security_verify_access:10.0.9.2:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:verify_identity_access:11.0.3:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
IBM Security Verify Access versions 10.0 to 10.0.9.2 and IBM Verify Identity Access versions 11.0 to 11.0.3 contain a heap-based out-of-bounds read vulnerability (CWE-125). This flaw can be triggered remotely by sending a specially crafted request, resulting in a denial of service condition due to memory access outside the allocated heap bounds. The CVSS v3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Confidentiality and integrity are not impacted, only availability is affected.
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by triggering a heap-based out-of-bounds read. There is no impact on confidentiality or integrity. The attack requires high complexity and no privileges or user interaction. No known exploits are reported in the wild.
Mitigation Recommendations
No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of affected services to untrusted networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-06-12T14:06:44.509Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac808d12cdf04f65634c8fa
Added to database: 10/08/2026, 21:19:13 UTC
Last enriched: 10/08/2026, 21:34:40 UTC
Last updated: 10/08/2026, 23:48:24 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.