The vulnerability is a stack-based buffer overflow in the asperahttpd component of IBM Aspera High-Speed Transfer Endpoint and Server. A buffer overflow can be triggered by a specially crafted request, allowing an attacker who has authenticated to the service to execute arbitrary code with the privileges of the service process. This flaw compromises the confidentiality, integrity, and availability of the affected system.

IBM Aspera High-Speed Transfer Endpoint and IBM Aspera High-Speed Transfer Server versions 3.7.4 through 4.4.7 Fix Pack 1 are affected. The official fix is the 4.4.7 Fix Pack 2 release for both products.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation as of this analysis. The attack requires authentication to asperahttpd, so the threat is primarily to users with legitimate access who can impersonate or misuse the service. Nevertheless, the ability to execute arbitrary code means that compromised accounts could give attackers full system control.