CVE-2026-82335 is a high severity (8.1) heap buffer overflow in the MongoDB protocol parser of IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker could send a MongoDB SCRAM username of excessive length and corrupt memory, causing denial of service or code execution. IBM's fix is the Sniffer patch in bulletin 7291674.
What's affected
IBM's bulletin 7291674 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2, in the Sniffer component on Linux. IBM's remediation for all affected versions is the latest Guardium Sniffer patch, named SqlGuard_12.0p4018_SnifferUpdate in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. One bulletin covers several CVEs, so one patch addresses the whole set.
How to check if you're exposed
Check each Guardium collector and aggregator for the installed patch level using your normal Guardium administration process, and compare it to the sniffer patch named in the bulletin. The bulletin is the authority for patch names, so read it before you start.
Also review where collectors sit. The record describes a remote attacker who can send crafted traffic that a collector inspects, so a collector that monitors untrusted or shared network segments carries the most exposure.
What to do now
- List every Guardium collector, aggregator and any other node running the Sniffer component on 12.0, 12.1 or 12.2.
- Apply the latest Guardium Sniffer patch named in IBM bulletin 7291674, testing it first on a non-production collector if you have one.
- Review which network segments feed your collectors, and limit untrusted traffic where you can.
- Confirm the patch level on every node afterwards.
- Watch the collector for crashes or restarts before and after patching, since parser flaws often show up that way.
Why it matters
The weaknesses are CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-787, out of bounds write. A length field from the network is trusted without a proper check against the destination buffer.
Parsers for network protocols are a common place for this. They handle hostile input by design. The vector marks attack complexity as high, so exploitation depends on conditions the attacker does not control. The record is not flagged in CISA's KEV catalog.
Protocol parsers in monitoring products have a particular risk profile. They exist to read traffic they do not control, so they must be written for hostile input. The record points to the MongoDB SCRAM username, a field that a client sets, and to an excessive length in it.
For defenders the useful question is placement. A Guardium collector or agent that watches database traffic from application servers sees traffic from systems you trust, but it may also see traffic from test hosts, partner networks or compromised machines. List which segments feed each collector, and ask which of them carry traffic you do not fully trust.
The patch covers several issues together. After applying it, check the patch level on every collector, because a single missed node keeps the whole set open. IBM's bulletin is the source for patch names, and it lists no workarounds.
Quick check
Which protocol is involved?
The record names the MongoDB protocol parser and the SCRAM username field. Other CVEs in the same patch involve the TDS protocol.
Sources
Last reviewed: 19 October 2026.
