CVE-2026-16340
IBM DataPower Gateway Out-of-bounds Write
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
Affected versions
- IBM DataPower Gateway 10.6CD
From 10.6.1 · through 10.6.6
- IBM DataPower Gateway 10.6.0
From 10.6.0.0 · through 10.6.0.10
- IBM DataPower Gateway 11.0.0
From 11.0.0.0 · through 11.0.0.2
- IBM DataPower Gateway 10.5.0
From 10.5.0.0 · through 10.5.0.22