CVE-2026-76587: IBM Planning Analytics Buffer Overflow
CWE-121 stack-based buffer overflow (memory-safety) in the TM1 C++ OData engine, reachable from authenticated REST.
Other sources
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Planning Analytics Localto a version that resolves this vulnerability.Fixed in 2.1.24
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated user who can reach the TM1 C++ OData engine through its REST interface.
Which component should be prioritized for review and remediation?
Prioritize IBM Planning Analytics deployments that expose or permit authenticated access to the TM1 C++ OData REST functionality.
What is the potential technical impact?
The issue is a stack-based buffer overflow in the TM1 C++ OData engine, which is a memory-safety flaw.