IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a buffer overflow in the Sniffer component that can be triggered remotely. The vulnerability allows an attacker to execute arbitrary code on the affected system. This flaw corresponds to CWE-120 and can lead to full compromise of the Guardium appliance, threatening confidentiality, integrity, and availability of protected data.

All releases of IBM Guardium Data Protection 12.0, 12.1, and 12.2 are affected. The Sniffer component in any of these versions can be abused by external actors, meaning that any instance running these releases without the latest patch is vulnerable.

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS data is unavailable, and the flaw is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a remote attacker sending crafted input to the Sniffer component over the network. Attackers would need network reach to the Sniffer interface or a privileged channel to send malicious input. Once exploited, arbitrary code execution can occur, giving attackers control over the Guardium appliance. The lack of public exploit evidence suggests moderate exploitability, but the high CVSS and remote nature warrant urgent action.