IBM DataPower Gateway products from versions 10.5.0.0 up to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10, and 11.0.0.0 to 11.0.0.2 contain a heap‑based buffer overflow caused by missing bounds checking. An unauthenticated attacker can supply crafted input that overflows a buffer and execute arbitrary code with the privileges of the gateway. This vulnerability can compromise the confidentiality, integrity, and availability of the device and any services processed by it.

The affected products are IBM DataPower Gateway, including the 10.5.x, 10.6.x, and 11.0.x series. Users running 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, or 11.0.0.0 through 11.0.0.2 must evaluate their current firmware and consider upgrade.

The CVSS score of 9.8 signals critical severity, and the vulnerability can be triggered remotely without authentication, making it highly attractive to attackers. Although the EPSS score is not available, the absence of a KEV listing does not lower its risks; attacks leveraging similar heap overflows have been documented in the field. Therefore, systems in production face a high probability of exploitation if unpatched and should treat this as a priority.