A buffer overflow occurs when the Sniffer component decodes a TDS PRELOGIN packet from Microsoft SQL Server. The vulnerability allows an attacker to send a crafted packet that overflows a buffer, which can cause a denial of service or, in the worst case, inject and execute arbitrary code. This is a classic bounds‑checking error (CWE‑119) that threatens confidentiality, integrity, and availability of the affected collector appliance.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are impacted, specifically the Sniffer component that monitors network traffic. The Collector appliances running these versions are at risk whenever they receive TDS packets from a SQL Server client or proxy. The product is known as IBM Guardium Data Protection 12.0.x, 12.1.x, and 12.2.x.

The CVSS score of 8.1 indicates serious risk. EPSS is not available, so the exact exploitation probability is unknown, but the vulnerability can be triggered remotely via a specially crafted packet, which is significant because it does not require local access. The vulnerability is not listed in the CISA KEV catalog; nevertheless, IBM advises immediate patching. An attacker would need to send a malicious PRELOGIN packet to a monitored network and can potentially crash the Collector or achieve privilege escalation. No advanced persistence mechanisms are described, yet the impact is severe if achieved.