CVE-2026-8175 is a heap-based buffer overflow vulnerability affecting IBM Aspera High-Speed Transfer Endpoint and Server versions 3.7.4 through 4.4.7 Fix Pack 1. The flaw resides in the asperahttpd component and can be triggered remotely over the network without authentication. Successful exploitation may cause denial of service and could potentially allow attackers to bypass authentication or execute arbitrary code remotely. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical), reflecting its high impact on confidentiality, integrity, and availability. As of the published date, no official patch or fix has been documented by IBM, and no known exploits have been reported in the wild.

The vulnerability can lead to denial of service conditions, authentication bypass, and remote code execution on affected IBM Aspera High-Speed Transfer Endpoint and Server installations. This poses a critical risk to system confidentiality, integrity, and availability. Given the network attack vector and lack of required privileges or user interaction, exploitation could be straightforward if an attacker targets vulnerable systems.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting network exposure of affected IBM Aspera components and monitor for unusual activity. No vendor-provided mitigations or temporary fixes are currently documented.