CVE-2026-82344 is a high severity (8.1) heap buffer overflow in the S-TAP TrafficTap TDS login reassembly code of IBM Guardium Data Protection 12.0 and 12.1. An unauthenticated remote attacker could send login fragments that exceed a fixed size buffer, causing denial of service or code execution on the host. IBM's fix is the Windows S-TAP patch.
What's affected
IBM's bulletin 7291670 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2 in the Windows S-TAP component. IBM's remediation for all affected versions is the latest Windows S-TAP patch, named Guardium_12.x.p101_r120203346_S-TAP_Windows in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. The record for CVE-2026-82344 names 12.0 and 12.1 specifically. Follow the bulletin for the exact scope.
How to check if you're exposed
List every Windows server that runs a Guardium S-TAP agent. These agents are usually deployed on database servers, so the inventory may sit with a database team and not a security team. Check each agent's version against the patch named in the bulletin.
The record describes a remote attacker sending crafted protocol data, so also note which hosts handle database traffic from untrusted sources.
What to do now
- Inventory every Windows S-TAP agent on Guardium 12.0, 12.1 and 12.2.
- Apply the latest Windows S-TAP patch named in IBM bulletin 7291670 after testing it on a non-production database host.
- Coordinate with the owners of each database server, since the agent runs on the host.
- Confirm the agent version after rollout.
- Check agent logs for crashes around the time of any suspicious traffic.
Why it matters
The weaknesses are CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-787, out of bounds write. Reassembly code joins fragments into one buffer. If the total is not checked against the buffer size, later fragments write past its end.
The agent runs on the database server itself, so a successful attack lands on a host that holds sensitive data. The vector marks attack complexity as high. The record is not flagged in CISA's KEV catalog.
Quick check
Why does reassembly code cause this kind of bug?
Because the final size is only known after all fragments arrive. A fixed buffer needs a size check on every fragment, and a missing check gives a write past the end.
Sources
Last reviewed: 19 October 2026.
