SB2026011963 - Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
Published: January 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2024-3568)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation within the load_repo_checkpoint() function of the TFPreTrainedModel() class. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Code Injection (CVE-ID: CVE-2025-1550)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the "Model.load_model" function. A local user can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Deserialization of Untrusted Data (CVE-ID: CVE-2025-8747)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data even when "safe_mode" is enabled. A remote attacker can trick the victim into loading a specially crafted Keras v3 model and execute arbitrary code on the system.
This vulnerability exists due to an incomplete fix for #VU106013 (CVE-2025-1550).
4) Heap-based buffer overflow (CVE-ID: CVE-2024-43598)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in LightGBM. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.