CVE-2026-84058

Summary

A buffer overrun vulnerability in IBM Guardium Data Protection's TDS PRELOGIN packet decoder allows remote attackers to cause denial of service or potentially execute arbitrary code on the Collector appliance when processing specially crafted SQL Server connection packets.

Exploitability

Exploitation requires sending a malformed TDS PRELOGIN packet to a Guardium Collector, which is moderately difficult without prior access but possible for external attackers who can reach the collector's network monitoring ports.

Blast radius

If exploited, this vulnerability could disrupt data protection monitoring capabilities across the enterprise, potentially allowing attackers to gain control of critical data security infrastructure and compromise sensitive data flows.

Detection

Monitor for异常的TDS PRELOGIN packet处理日志或网络流量模式，特别是来自非标准SQL Server客户端的连接尝试。如果需要更具体的检测，可以查看Guardium Collector的日志文件中与TDS协议解析相关的错误信息。

Prioritized remediation

Upgrade to IBM Guardium Data Protection 12.2.1 or later to address this buffer overrun vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.