The vulnerability is a stack‑based buffer overflow that allows a remote authenticated attacker to execute arbitrary code on IBM API Connect environments. It originates from improper bounds checking and results in full compromise of the affected system with no user interaction beyond authentication.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted.

The CVSS score of 7.2 indicates a high severity. EPSS is not available, so the current exploitation probability cannot be quantified, but the lack of known public exploitation combined with the remote authenticated nature suggests a moderate but non‑negligible risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker who authenticates to the API Connect environment and triggers the overflow through a crafted request.