The vulnerability arises from improper validation of user-supplied pointers in the WfpMonitor kernel driver used by IBM Guardium Data Protection’s Windows S‑TAP component. The driver’s METHOD_NEITHER IOCTL handlers dereference pointers provided by a local user without sufficient probing or exception handling, allowing a privileged local attacker to cause a system crash or read restricted kernel memory. This results in denial of service and the potential for limited information disclosure, but does not enable arbitrary code execution or remote attack.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 running the Windows S‑TAP component are affected. The vulnerability is exclusive to the Windows environment in which the kernel driver operates and can impact any system installed with these Guardium Data Protection releases.

The CVSS score of 5.1 indicates medium severity. No EPSS metric is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known, widely used exploits. However, the attack requires a privileged local user; systems that allow local administrators or users with elevated rights can potentially exploit the flaw, leading to a crash or kernel memory read. Given the limited scope of the impact, the overall risk is moderate but warrants prompt mitigation.