IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.
**Risk verdict:** Urgently assess internet- or broadly reachable deployments; the supplied data does not establish active exploitation, but unauthenticated network reachability and potentially severe impact warrant prompt remediation.
**Why this matters:** A successful attack could disrupt database monitoring or expose sensitive information, undermining both service availability and confidence in security controls. The parser’s position in a data-protection environment may make outages particularly consequential, even if the affected component does not itself store the monitored data. KEV, SSVC, PoC and EPSS indicators are not provided, so exploitation likelihood cannot be independently ranked.
**Most likely attack path:** An attacker sends a crafted TDS LOGIN7 packet to a reachable parser; no credentials or user action are required. High attack complexity suggests specific conditions or carefully formed traffic are needed, while unchanged scope limits the assessed impact to the vulnerable security authority; lateral movement is not established by the available data.
**Who is most exposed:** Prioritise organisations using Windows S-TAP deployments and those with database protocol paths reachable from untrusted or shared networks. Internet exposure is not confirmed and should be checked.
Review network flows for unexpected TDS LOGIN7 traffic to S-TAP hosts.
Check service and system logs for parser crashes, restarts or repeated connection failures.
Investigate anomalous connections from untrusted sources and unusual database-monitoring gaps.
Mitigation and prioritisation
Apply IBM’s recommended latest Windows S-TAP patch after validating platform applicability.
Restrict TDS access to required database and monitoring peers; block unnecessary ingress.
Test changes in a representative environment and monitor sensor health after rollout.
Confirm all deployed agents are covered; obtain EPSS and exploitation-status data to refine urgency.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
