CVE-2026-82335: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer in IBM Guardium Data Protection

CVE-2026-82335 is a heap-based buffer overflow vulnerability (CWE-119) in IBM Guardium Data Protection 12.0, 12.1, and 12.2. The issue exists in the MongoDB protocol parser, where processing a MongoDB SCRAM username of excessive length can cause memory corruption. This can be exploited remotely without privileges or user interaction, potentially resulting in denial of service or arbitrary code execution. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, and no user interaction.

Successful exploitation can lead to memory corruption causing denial of service or arbitrary code execution on affected systems running IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. This could allow remote attackers to compromise the confidentiality, integrity, and availability of the system.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the MongoDB protocol interface and monitoring for anomalous input lengths in SCRAM usernames if possible.