CVE-2026-82335 is a heap-based buffer overflow in the MongoDB wire-protocol parser inside IBM Guardium Data Protection's database-activity-monitoring Sniffer component, where an oversized SCRAM authentication username sent over the MongoDB protocol overruns a fixed-size buffer, letting a remote and unauthenticated attacker corrupt memory on the monitoring appliance with the potential for arbitrary code execution rather than just a crash.
Vulnerability summary
9.8
Critical
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-08
Published
Vulnerability ID: CVE-2026-82335 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| IBM Guardium Data Protection | cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* | 12.0, 12.1, 12.2 (patch via SqlGuard Sniffer Update; see IBM Fix Central) |
What this means
CVE-2026-82335 (CWE-787, Out-of-bounds Write) affects IBM Guardium Data Protection, IBM's database-activity-monitoring and data-security platform, which passively or inline inspects database traffic — including MongoDB's wire protocol — via a component IBM calls the Sniffer (also branded SqlGuard). NVD's description states: "IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution" (NVD). SCRAM (Salted Challenge Response Authentication Mechanism) is the default authentication mechanism for modern MongoDB deployments, so a Guardium Sniffer monitoring MongoDB traffic parses SCRAM exchanges, including the client-supplied username, as part of normal operation.
NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. IBM's own CNA submission scores it substantially lower, CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — the vendor rates attack complexity as High rather than Low, where NVD's Primary re-analysis treats the crafted-username trigger as reliably reachable without additional preconditions (GitHub Advisory Database GHSA-29m4-fpp8-q5f8).
IBM's own security bulletin (Document ID ibm17291674, published 2026-10-08) confirms the same affected versions — Guardium Data Protection 12.0, 12.1, and 12.2 — and IBM's own CVSS base score of 8.1. The bulletin directs administrators to apply the latest Sniffer patch through IBM Fix Central, naming SqlGuard_12.0p4018_SnifferUpdate as the specific patch for version 12.0, with equivalent updates for 12.1 and 12.2, and states that no mitigation or workaround is available short of applying the patch (IBM Security Bulletin, Document ID ibm17291674).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00381 (32.1st percentile) (FIRST EPSS). CVE-2026-82335 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).
Any organization running IBM Guardium Data Protection 12.0, 12.1, or 12.2 with MongoDB monitoring enabled should apply the corresponding Sniffer patch from IBM Fix Central as soon as possible; because the Sniffer sits in the path of live database traffic, a monitoring appliance that itself gets compromised by this bug could undermine the very data-security controls it was deployed to provide.
Evidence
- IBM Guardium Data Protection 12.0, 12.1, 12.2 has a heap-based buffer overflow in its MongoDB protocol parser; a remote attacker can send an oversized MongoDB SCRAM username to cause memory corruption, potentially resulting in denial of service or arbitrary code execution. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); IBM's own CNA submission scores it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), rating attack complexity as High rather than Low. — GitHub Advisory Database
- IBM Security Bulletin (ibm17291674, published 2026-10-08) confirms the affected versions and IBM's CVSS 8.1 score, and directs administrators to apply the SqlGuard Sniffer patch (e.g. SqlGuard_12.0p4018_SnifferUpdate for 12.0) via IBM Fix Central, with no other documented mitigation. — IBM Security Bulletin
- EPSS score is 0.00381 (32.1st percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS
