CVE-2026-84290: Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.
Other sources
IBM Security Guardium Data Protection is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHODNEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protection Windows S-TAPto a version that resolves this vulnerability.Patch Guardium_12.x.p102_r120204351_S-TAP_Windows
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and high privileges. The provided vector does not indicate remote exploitation or user interaction is required.
Which deployments are known to be affected?
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are identified as affected. The issue is in the Windows S-TAP component's WfpMonitor kernel driver.
What could successful exploitation allow?
A privileged local attacker may be able to crash the system or perform limited reads of kernel memory. Integrity impact is not indicated in the supplied severity vector.