CVE-2026-84058: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.
Other sources
IBM Guardium Data Protection is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SqlGuard_12.0p4018_SnifferUpdate
Event History
Frequently Asked Questions
Which deployments are exposed?
IBM Guardium Collector appliances are exposed when they monitor network traffic that includes Microsoft SQL Server TDS PRELOGIN packets an attacker can inject or send.
What does an attacker need to exploit this issue?
The attacker needs the ability to send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector. No authentication requirement or affected default configuration is specified in the available information.
What is the potential impact on the Collector?
Successful exploitation may cause a denial of service on the Collector appliance or could potentially allow arbitrary code execution on it.