CVE-2026-14988: CWE-125 Out-of-bounds Read in IBM DataPower Gateway 10.6CD

CVE-2026-14988 affects multiple versions of IBM DataPower Gateway, specifically versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The vulnerability is an out-of-bounds read (CWE-125) that results in a buffer overflow. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, with low attack complexity. The impact is limited to confidentiality loss and availability degradation. There is no vendor advisory or patch information provided in the input data, and no known exploitation in the wild has been reported.

The vulnerability allows an unauthenticated attacker to perform an out-of-bounds read that can cause a buffer overflow, potentially leading to limited confidentiality loss and availability impact. The CVSS score of 6.5 reflects a medium severity with network attack vector and no privileges required. No integrity impact is indicated. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, organizations should monitor IBM's security advisories for updates. Until a patch is available, consider limiting network exposure of affected IBM DataPower Gateway versions and applying any recommended vendor mitigations once published.