Technical impact
IBM Concert Software versions 1.0.0 through 3.0.0 contain a buffer overflow caused by improper bounds checking, which allows a local user to overflow the buffer and execute arbitrary code on the system. This flaw can lead to full system compromise, representing a severe threat to confidentiality, integrity, and availability. This weakness is categorized as CWE-120.
Affected Systems
The affected products are IBM Concert Software versions 1.0.0 and 3.0.0. No later versions have been identified as vulnerable.
Risk and Exploitability
The vulnerability has a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, so the current exploitation probability is unknown, but the flaw requires local user access to exploit. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely reported or exploited in the wild. An attacker with local access could trigger the overflow by submitting specially crafted input to the application, leading to arbitrary code execution.
