CVE-2026-17481 is a high severity (CVSS 8.8) flaw in IBM Documentation Offline 1.0.0 through 1.4.1. Improper output neutralization for logs could let a remote attacker on an adjacent network run arbitrary code. IBM says to download and install the latest release, 1.5.1, and lists no workaround.
What's affected
IBM Documentation Offline, versions 1.0.0 through 1.4.1. IBM describes the product as a desktop application that bundles an Electron based viewer with an embedded Node.js web server that serves product documentation locally.
The fix is release 1.5.1. IBM's bulletin lists no workaround or mitigation. The bulletin was first published on 13 August 2026 and covers several issues in the embedded server, in categories IBM labels information disclosure, session forgery and remote code execution.
How to check if you're exposed
Open the application and check its version in the About dialog or the installed applications list on the workstation. Versions from 1.0.0 to 1.4.1 are affected.
IBM says the embedded server bound its network sockets to all available interfaces instead of only the loopback address. That is why the attack vector is adjacent, so check whether other machines on the same network could reach the port. On a workstation, list listening sockets and look for the documentation server.
lsof -iTCP -sTCP:LISTEN -n -P
A listener on all interfaces, rather than 127.0.0.1, matches the condition IBM describes.
What to do now
- Find workstations that have IBM Documentation Offline installed, using your software inventory.
- Install release 1.5.1 and confirm the version afterward.
- Until then, close the application when you are not using it, and avoid running it on shared or untrusted networks.
- Remove copies you no longer use.
Why it matters
The weakness is CWE-117 (Improper Output Neutralization for Logs). When a program writes untrusted text into a log without neutralizing special content, that content can be read as something else later, depending on how the log is used. IBM says this one could let a remote attacker execute arbitrary code.
The listed vector is adjacent, with low complexity, no privileges and no user interaction, and high impact on all three goals. A local help viewer is easy to overlook in a software inventory, yet binding to every interface turned a local tool into a network service. CISA does not list this CVE as known exploited.
Quick check
Why is a local documentation viewer a network risk?
IBM says its embedded server listened on all network interfaces, not only loopback, so other machines on the same network could reach it.
Sources
Last reviewed: 19 October 2026.
