CVE-2026-12091CWE-125
CVE-2026-12091
Low · published October 9, 2026
What it is
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.
The record
Technical detail
- CVSS v3.1
- 3.7 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00298 · 21.3th percentile
- Weakness
- CWE-125 · Out-of-bounds Read
- Published
- 2026-10-09T01:17Z
Affected products (4)
| Product | Versions | Fixed in |
|---|
| ibm/security_verify_access | ≥ 10.0.0, < 10.0.9.3 | 10.0.9.3 |
| ibm/security_verify_access_container | ≥ 10.0.0.0, ≤ 10.0.9.2 | — |
| ibm/verify_identity_access | ≥ 11.0, < 11.0.3.1 | 11.0.3.1 |
| ibm/verify_identity_access_container | ≥ 11.0.0.0, ≤ 11.0.3.0 | — |
References (1)
EPSS history
Timeline
10 OCT 03:27Z
EPSS moved — → 0%
epss
08 OCT 21:02Z
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
cvelistv5
08 OCT 21:02Z
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
cvelistv5