CVE-2026-16170: CWE-787 Out-of-bounds Write in IBM DataPower Gateway 10.6CD

This vulnerability (CVE-2026-16170) affects multiple versions of IBM DataPower Gateway, specifically versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. It is classified as CWE-787 (Out-of-bounds Write) and allows a remote attacker to cause a denial of service by triggering a heap buffer overflow. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits in the wild are reported. Patch or remediation details are not provided in the input.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service condition on affected IBM DataPower Gateway instances. There is no impact on confidentiality or integrity according to the CVSS vector. This could disrupt service availability but does not appear to allow code execution or data compromise based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting network exposure of affected IBM DataPower Gateway versions and monitor for unusual service disruptions. Do not assume a patch exists without vendor confirmation.