CVE-2026-6794

Multiple Vulnerabilities in IBM Concert Software

View on CVE.org
Published Sep 23, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.

Analysis

AI-generated

Technical impact

IBM Concert Software versions 1.0.0 through 3.0.0 contain a double free flaw caused by incorrect memory management. This defect allows a local attacker to corrupt heap memory and execute arbitrary code in the context of the affected process, classified as CWE-415.

Affected Systems

The vulnerability affects IBM Concert Software versions 1.0.0, 1.0.0‑through‑3.0.0, and any build that uses the same code base. In practice the affected releases include the widely deployed 3.0.0 release and earlier 1.x releases.

Risk and Exploitability

The CVSS base score of 7.8 indicates a high severity, but the exploit requires local access to the target machine and the EPSS score is not reported. Because the flaw is not listed in the CISA KEV catalog, it is not known to be widely exploited in the wild yet, but its ability to execute code locally warrants immediate attention.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.1.1 as recommended by IBM.
  • If an upgrade is not yet feasible, restrict local access to the affected services and isolate the system from untrusted users.
  • Monitor the system for signs of heap corruption or abnormal process crashes and apply any interim security controls.

Generated by OpenCVE AI on September 23, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-415
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Sep 25, 2026, 3:55 AM
Reserved
Apr 21, 2026, 2:15 PM

View source JSON

Updated
Sep 24, 2026, 1:33 PM

JSON

Status
Analyzed
Published
Sep 23, 2026, 9:17 PM
Modified
Sep 28, 2026, 8:47 PM

View source JSON

No data.

Updated
Sep 23, 2026, 11:15 PM

JSON