IBM DataPower Gateway software contains an out‑of‑bounds write that can be triggered by a remote attacker, resulting in a buffer overflow that brings the device to a denial of service state. The vulnerability is classified as CWE‑787, which denotes an untrusted write beyond a buffer’s boundaries and can corrupt memory and halt processing. When the overflow occurs the gateway stops responding to requests, potentially disrupting traffic and service availability.

The affected products are IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. These are the revisions listed by the CNA, covering the 10.5, 10.6, 10.6CD, and 11.0 product lines.

The CVSS score of 7.5 signals a high potential impact if exploited. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the vulnerability is unknown to CISA KEV, meaning no public exploits are documented. The remote nature of the attack is inferred from the description, indicating an attacker who can reach the gateway’s network interfaces can overflow the buffer and force a reboot or crash. Given the severity and potential for widespread denial of service, urgent remediation is advised.