CVE-2026-84058 is a high severity (8.1) buffer overrun in the TDS PRELOGIN packet decoder of IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker who can send a crafted packet to a network watched by a Guardium Collector could cause denial of service or possibly run code there. IBM's fix is the sniffer patch in bulletin 7291674.
What's affected
IBM's bulletin 7291674 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2, in the Sniffer component on Linux. IBM's remediation for all affected versions is the latest Guardium Sniffer patch, named SqlGuard_12.0p4018_SnifferUpdate in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. One bulletin covers several CVEs, so one patch addresses the whole set.
How to check if you're exposed
Check each Guardium collector and aggregator for the installed patch level using your normal Guardium administration process, and compare it to the sniffer patch named in the bulletin. The bulletin is the authority for patch names, so read it before you start.
Also review where collectors sit. The record describes a remote attacker who can send crafted traffic that a collector inspects, so a collector that monitors untrusted or shared network segments carries the most exposure.
What to do now
- List every Guardium collector, aggregator and any other node running the Sniffer component on 12.0, 12.1 or 12.2.
- Apply the latest Guardium Sniffer patch named in IBM bulletin 7291674, testing it first on a non-production collector if you have one.
- Review which network segments feed your collectors, and limit untrusted traffic where you can.
- Confirm the patch level on every node afterwards.
- Watch the collector for crashes or restarts before and after patching, since parser flaws often show up that way.
Why it matters
The weakness is CWE-119, improper restriction of operations within the bounds of a memory buffer. TDS is the protocol used by Microsoft SQL Server, and PRELOGIN is the first packet in a connection, sent before any authentication.
That placement is what makes it serious. The attacker does not need an account on the database. The attacker needs only to send traffic that the collector inspects. The record is not flagged in CISA's KEV catalog.
Quick check
Does the attacker need a database login?
The record says the attacker sends a crafted PRELOGIN packet, which is an early connection step. The record does not describe any login requirement.
Sources
Last reviewed: 19 October 2026.
