IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.
**Risk verdict:** High operational risk: prioritise prompt remediation of exposed Windows S-TAP deployments, while confirming exploitation status because KEV, SSVC, PoC and EPSS data were not provided.
**Why this matters:** A successful attack could interrupt database traffic monitoring or enable code execution on the affected host. Because Guardium components may observe sensitive database activity, a compromised sensor could also expose monitoring data or provide a foothold into reachable systems; further access is not implied by the vulnerability itself.
**Most likely attack path:** An attacker needs network reachability to the S-TAP TrafficTap handling TDS logins, but no credentials or user action are required. The high attack complexity may limit reliable exploitation; scope is unchanged, so any lateral movement would depend on the host’s privileges, connectivity and trust relationships.
**Who is most exposed:** Organisations running Windows S-TAP to monitor SQL Server traffic are most relevant, particularly where database-facing network paths are reachable from untrusted or broadly accessible networks.
Alert on malformed or unusually fragmented TDS login traffic reaching S-TAP.
Check for unexpected S-TAP service crashes, restarts or host instability.
Review endpoint telemetry for anomalous child processes or outbound connections from the S-TAP host.
Correlate database-monitoring gaps with network and host events.
Mitigation and prioritisation:
Apply IBM’s latest Windows S-TAP patch for affected deployments; validate the installed component and fix level.
Restrict network access to required database traffic sources while patching.
Prioritise internet- or untrusted-network-reachable sensors and test the change in a representative environment.
Confirm KEV, SSVC, PoC and EPSS status before setting final urgency; those indicators are absent here.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
