CVE-2026-13473 is a high severity heap buffer overflow (CVSS 8.1) in IBM Storage Protect Client 8.1.0.0 through 8.2.1.0. A remote attacker could run code on the system or crash it. IBM recommends fixing level 8.2.1.2 on Windows and lists no workaround for this one.
What's affected
IBM lists these versions as affected:
- IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, and 8.1.27.1
- IBM Storage Protect Client 8.2.0.0 through 8.2.1.0
The fixing level is 8.2.1.2 on Windows. IBM publishes manual upgrade paths. From 8.1.0.0 to 8.1.27.0, go to 8.2.1.0 and then 8.2.1.2. From 8.2.0.0 to 8.2.1.0, go straight to 8.2.1.2. With Client Auto Deploy, 8.1.27.0 and 8.1.27.1 go to 8.2.0.0 and then 8.2.1.2. IBM lists no workarounds.
How to check if you're exposed
On a Windows machine, open the backup archive client and read the version under Help, or check the installed program list. Compare it with the two ranges above. Run an inventory across servers that use the client, because backup agents often sit on many machines and get forgotten.
Check for the client service on servers as well as desktops. Backup agents are often installed once and forgotten. Your backup administrator will have a list of registered nodes, which is a better inventory than a scan of the network.
After the upgrade, run a test backup and restore on a sample node to confirm that nothing broke.
What to do now
- Inventory every host with Storage Protect Client.
- Follow IBM upgrade paths for your starting version to reach 8.2.1.2.
- Use Client Auto Deploy if you manage many hosts, following IBM paths.
- Check IBM known issues and limitations before the rollout.
- Verify the version after the upgrade on a sample of machines.
- Keep the IBM node list of Storage Protect clients with versions, and refresh it after the rollout.
Why it matters
A heap based buffer overflow means the program writes past the end of a block of memory, caused here by improper bounds checking. Depending on the layout, that can corrupt data, crash the process or allow code execution. Backup clients usually run with high privilege because they must read everything, which raises the stakes.
The vector shows high attack complexity, which keeps the score at 8.1. IBM credits the report to two named parties in its bulletin. The record does not flag this CVE as known exploited.
Backup clients run with high privilege because they read everything. A memory bug in such a client is a stronger finding than the same bug in an ordinary program. The bulletin says the vulnerability was reported to IBM by two named parties, and that is all the record tells us about its source.
The record lists this weakness class: CWE-122 (Heap-based Buffer Overflow).
Quick check
Which version is the fix?
IBM names fixing level 8.2.1.2 for the Windows client. Follow the upgrade path for your current version.
Can I jump straight to the fixed level?
IBM publishes specific upgrade paths. From the 8.2.0.0 to 8.2.1.0 range, go straight to 8.2.1.2. From 8.1 versions, IBM says to go through 8.2.1.0 first or follow the Client Auto Deploy path.
Sources
Last reviewed: 19 October 2026.
