CVE-2026-82334 is a high severity (8.1) heap-based out-of-bounds read in the TDS7 LOGIN7 parser of IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker could send a crafted packet with invalid offset or length values, causing information disclosure or denial of service. IBM's fix is the Windows S-TAP patch in bulletin 7291670.
What's affected
IBM's bulletin 7291670 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2 in the Windows S-TAP component. IBM's remediation for all affected versions is the latest Windows S-TAP patch, named Guardium_12.x.p101_r120203346_S-TAP_Windows in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. The record for CVE-2026-82344 names 12.0 and 12.1 specifically. Follow the bulletin for the exact scope.
How to check if you're exposed
List every Windows server that runs a Guardium S-TAP agent. These agents are usually deployed on database servers, so the inventory may sit with a database team and not a security team. Check each agent's version against the patch named in the bulletin.
The record describes a remote attacker sending crafted protocol data, so also note which hosts handle database traffic from untrusted sources.
What to do now
- Inventory every Windows S-TAP agent on Guardium 12.0, 12.1 and 12.2.
- Apply the latest Windows S-TAP patch named in IBM bulletin 7291670 after testing it on a non-production database host.
- Coordinate with the owners of each database server, since the agent runs on the host.
- Confirm the agent version after rollout.
- Check agent logs for crashes around the time of any suspicious traffic.
Why it matters
The weakness is CWE-125, out of bounds read. The parser trusts offset and length values in the packet and reads memory outside the intended buffer. Reads can leak data from memory or crash the process.
LOGIN7 is the login packet in the TDS protocol used by Microsoft SQL Server. The record is not flagged in CISA's KEV catalog. A companion flaw, CVE-2026-82344, affects the login reassembly path in the same agent.
Quick check
What are offset and length fields?
They are values inside a packet that tell a parser where data starts and how long it is. If the parser does not check them against the real buffer, it can read or write out of bounds.
Sources
Last reviewed: 19 October 2026.
