Out-of-bounds write in uuid - CVE-2026-41907

Vulnerability identifier: #VU132376

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41907

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to accepting external output buffers, but not rejecting out-of-range writes (small buf or large offset). A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

uuid
Optim
Event Processing
Storage Fusion Data Foundation
Maximo Application Suite - Visual Inspection Component
IBM Event Endpoint Management
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Application Modernization Accelerator
InfoSphere Optim Archive Viewer
IBM Cloud Transformation Advisor
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Tivoli Netcool/OMNIbus WebGUI
Bamboo Data Center
IBM Decision Optimization for Cloud Pak for Data
IBM App Connect Enterprise

Install updates from vendor's website.

uuid - addressed in versions 11.1.1, 12.0.1, 13.0.1
Optim - update to 2.0.0
Event Processing - update to 1.5.5
IBM Cloud Transformation Advisor - update to 5.0.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
Storage Fusion Data Foundation - update to 4.22
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.20, 9.1.17
Bamboo Data Center - update to 10.2.22
IBM Event Endpoint Management - update to 11.8.2
IBM App Connect Enterprise - addressed in versions 12.0.12.27, 13.0.8.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq

• Out-of-bounds write in uuid
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• IBM InfoSphere Optim Archive Viewer update for uuid
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• IBM Watson Discovery Cartridge update for uuid
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for uuid
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM Event Endpoint Management
• IBM Optim update for uuid
• IBM Fusion Data Foundation update for uuid