CVE-2026-84035 is a high severity (8.1) stack-based buffer overflow in IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker could potentially execute arbitrary code. IBM fixes it with the latest Guardium Sniffer patch named in bulletin 7291674. The bulletin lists no workaround, so patching is the only listed remedy.
What's affected
IBM's bulletin 7291674 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2, in the Sniffer component on Linux. IBM's remediation for all affected versions is the latest Guardium Sniffer patch, named SqlGuard_12.0p4018_SnifferUpdate in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. One bulletin covers several CVEs, so one patch addresses the whole set.
How to check if you're exposed
Check each Guardium collector and aggregator for the installed patch level using your normal Guardium administration process, and compare it to the sniffer patch named in the bulletin. The bulletin is the authority for patch names, so read it before you start.
Also review where collectors sit. The record describes a remote attacker who can send crafted traffic that a collector inspects, so a collector that monitors untrusted or shared network segments carries the most exposure.
What to do now
- List every Guardium collector, aggregator and any other node running the Sniffer component on 12.0, 12.1 or 12.2.
- Apply the latest Guardium Sniffer patch named in IBM bulletin 7291674, testing it first on a non-production collector if you have one.
- Review which network segments feed your collectors, and limit untrusted traffic where you can.
- Confirm the patch level on every node afterwards.
- Watch the collector for crashes or restarts before and after patching, since parser flaws often show up that way.
Why it matters
The weakness is CWE-121, stack-based buffer overflow. Data written past the end of a stack buffer can overwrite control data such as return addresses. Modern builds add protections that make this harder, which fits the high attack complexity in the vector.
IBM does not name the component or the input involved in this record. The record is not flagged in CISA's KEV catalog.
Quick check
Do compiler protections remove the risk?
They raise the cost of exploitation, which the high complexity rating reflects. They do not replace the patch.
Sources
Last reviewed: 19 October 2026.
