This vulnerability is an unbounded write to a fixed‑size stack buffer that, when exploited, can lead to arbitrary code execution. It affects IBM Verify Identity Access versions 11.0.0 through 11.0.3 and IBM Security Verify Access versions 10.0.0 through 10.0.9.2. The weakness is classified as CWE‑787. Only users with administrative privileges who can access the local management interface can trigger the buffer overflow, but once triggered the attacker could gain elevated privileges and control over the affected system.

Affected systems are IBM Verify Identity Access and IBM Security Verify Access installations, including their containerized variants. Vulnerable versions are IBM Verify Identity Access 11.0.0 through 11.0.3 and IBM Security Verify Access 10.0.0 through 10.0.9.2. The same version ranges apply to the corresponding container releases.

The CVSS score of 5.5 indicates a medium impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attacks require local access with administrative privileges to the management interface, reducing the exposure compared to remote exploits. Nevertheless, once the buffer overflow is triggered, an attacker could achieve arbitrary code execution with elevated privileges. Prompt patching is recommended.