IBM Datacap 9.1.7 through 9.1.9 and Datacap Navigator 9.1.7 through 9.1.9 contain a flaw that lets an attacker read passwords and cryptographic keys from process memory. By extracting these secrets, the attacker can decrypt stored passwords, authenticate themselves to the application, and subsequently read or modify sensitive database records.

IBM Datacap versions 9.1.7, 9.1.8, and 9.1.9 together with IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 are affected.

The CVSS score of 5.5 indicates a moderate threat level. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation but still a significant risk to systems that rely on these products. The description does not state the exact attack vector; it is inferred that the attacker needs either local system or application access sufficient to read memory, or exploitation of an existing vulnerability that permits such access.