CVE-2026-84875 is a high severity (CVSS 7.5) buffer overflow in the Sniffer component of IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker could execute arbitrary code. IBM says to apply the latest Sniffer patch for all affected versions.
What's affected
The record and IBM's bulletin agree: IBM Guardium Data Protection 12.0, 12.1 and 12.2, specifically the Sniffer component. IBM's remediation for all affected versions is the latest Guardium Sniffer patch, SqlGuard_12.0p4018_SnifferUpdate, available from Fix Central through the bulletin. It lists no workarounds or mitigations. The bulletin's change history shows an initial publication on 8 October 2026.
The vector is network, high complexity and low privileges, with high impact across confidentiality, integrity and availability. IBM's text is two lines and does not describe the entry point, so I will not either. The same bulletin lists another buffer overflow with a higher score, so it is worth reading in full.
How to check if you're exposed
Find the Guardium version on each appliance. In the appliance's command line interface, the version command reports the release, and the patch history shows which bundles and fixes have been installed. In the web interface, the about page shows the same information. Use the command your Guardium administrator already knows, since the exact CLI differs between releases.
Compare the version and installed patches with the fix listed in IBM's bulletin. Also work out how the appliance is exposed. List the networks that can reach its management and collector interfaces, and who holds an account. The CVSS vector for this CVE tells you what an attacker needs, so use it to rank your appliances: those that face broad internal networks come first.
What to do now
- Download IBM's latest Sniffer patch, SqlGuard_12.0p4018_SnifferUpdate, and apply it to every affected appliance.
- Confirm which of your appliances run the Sniffer component and put those first.
- Limit which networks and accounts can reach the appliances that run it.
- Test the patch in a non-production setting if you have one, then roll out within your normal change window.
- Record the patch state of each appliance in your inventory.
Why it matters
A buffer overflow, tracked as CWE-119, means a program reads or writes beyond the limits of a memory region. When it writes, an attacker may corrupt control data and run code. The Sniffer component inspects traffic, which means it handles data from many sources, some of them hostile. Software that parses untrusted network data at a high privilege level is where such bugs hurt most.
Complexity is rated high and a low privilege account is needed, which holds the score at 7.5. Still, an unpatched memory safety bug in a monitoring component deserves a prompt update. The record does not list this CVE as exploited in the wild.
Quick check
Is this a remote attack?
Yes. The vector is network, though IBM rates complexity high and needs a low privilege account.
Do I need to patch each Guardium release separately?
IBM lists one Sniffer patch for all affected versions, 12.0, 12.1 and 12.2.
Sources
Last reviewed: 18 October 2026.
