IBM Sterling Connect Direct for Unix’s apnotify utility contains a buffer overflow that allows an attacker to inject arbitrary code because user input is not properly validated. The flaw can compromise confidentiality, integrity, and availability of the affected system if triggered, potentially granting attacker control over the host running the service.

Vulnerable products are IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7. The known affected versions include 6.4.0.0‑6.4.0.6 and 6.3.0.0‑6.3.0.7, as documented in the Common Platform Enumeration strings for those releases.

The CVSS score of 7.8 indicates a high severity vulnerability, though the EPSS score is not available and the issue is not in CISA’s KEV catalog. The attack vector is likely local or remote depending on how apnotify is invoked, but the description does not specify network exposure; therefore the exact attack surface is uncertain. No public exploits have been reported at the time of analysis.