Description
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Code Execution (Local)
Action: Immediate Patch
AI Analysis

Impact

IBM Concert Software versions 1.0.0 through 3.0.0 contain a double free flaw caused by incorrect memory management. This defect allows a local attacker to corrupt heap memory and execute arbitrary code in the context of the affected process, classified as CWE-415.

Affected Systems

The vulnerability affects IBM Concert Software versions 1.0.0, 1.0.0‑through‑3.0.0, and any build that uses the same code base. In practice the affected releases include the widely deployed 3.0.0 release and earlier 1.x releases.

Risk and Exploitability

The CVSS base score of 7.8 indicates a high severity, but the exploit requires local access to the target machine and the EPSS score is not reported. Because the flaw is not listed in the CISA KEV catalog, it is not known to be widely exploited in the wild yet, but its ability to execute code locally warrants immediate attention.

Generated by OpenCVE AI on September 23, 2026 at 22:51 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.1.1 as recommended by IBM.
  • If an upgrade is not yet feasible, restrict local access to the affected services and isolate the system from untrusted users.
  • Monitor the system for signs of heap corruption or abnormal process crashes and apply any interim security controls.

Generated by OpenCVE AI on September 23, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Thu, 24 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-415
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Concert
Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-25T03:55:21.295Z

Reserved: 2026-04-21T14:15:12.960Z

Link: CVE-2026-6794

cve-icon Vulnrichment

Updated: 2026-09-24T13:33:59.548Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T21:17:02.177

Modified: 2026-09-28T20:47:40.060

Link: CVE-2026-6794

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses