A stack-based buffer overflow exists in the Sniffer component of IBM Guardium Data Protection, allowing a remote attacker to run arbitrary code on systems with vulnerable versions. The vulnerability falls under CWE-121, where an overflow of a buffer during stack usage can lead to execution of attacker‑controlled code, thereby breaching confidentiality, integrity, and availability of the protected data and underlying infrastructure.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are affected. These versions include the Sniffer component, which can be accessed remotely if properly exposed by the environment. Users running any of these releases should review their configuration to verify whether the Sniffer is exposed to untrusted networks.

The CVSS v3.1 score of 8.1 signals a high‑severity flaw. While an EPSS score is not available, the lack of KEV listing does not diminish the potential for exploitation, particularly because a stack overflow can be triggered over the network or via a crafted input. The likely attack vector involves remote interaction with the Sniffer service; an attacker may supply a malicious payload that overflows the buffer, leading to arbitrary code execution. Due to the nature of the overflow, the impact is limited to the host running the vulnerable Sniffer instance, but the compromised host may become a foothold for further attacks.