CVE-2026-84246 is a second buffer overflow in IBM Guardium Data Protection 12.0, 12.1 and 12.2 that could allow remote code execution (CVSS 8.1, high). It shares an IBM bulletin with CVE-2026-84198, and one Sniffer patch is the fix. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record and the IBM bulletin give the same description as the sibling entry: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to a buffer overflow. Affected versions are 12.0, 12.1 and 12.2, and the bulletin ties them to the Sniffer component. The weakness is CWE-120.
IBM names the Sniffer update SqlGuard_12.0p4018_SnifferUpdate as the remediation and lists no workarounds. The record is not in the CISA KEV catalog.
How to check if you're exposed
Confirm the Sniffer patch level on each collector in the Guardium administration interface. If SqlGuard_12.0p4018_SnifferUpdate or a later patch is not applied, the appliance is exposed to this entry and its siblings.
What to do now
- Apply the Sniffer update named in IBM bulletin 7291674.
- Verify the patch on every collector and aggregator.
- Track CVE-2026-84198 and this entry together, since one patch closes both.
- Limit which networks can reach the monitored database traffic paths and the appliances.
Why it matters
Two CVE ids for the same description usually mean two separate code paths with the same mistake. Here that is a memory write past a buffer in input handling. Fixing one without the other would leave the door open, which is why IBM ships a single patch.
For tracking, link both ids to one remediation ticket. Scanners will report each id separately, and teams that close only one are a common source of repeat findings.
Quick check
Why are there two CVEs with the same text?
They are separate flaws with the same weakness type. The same Sniffer patch addresses both, so one ticket is enough.
Sources
Last reviewed: 19 October 2026.
