Out-of-bounds write in uuid - CVE-2026-41907

Vulnerability identifier: #VU132376

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41907

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to accepting external output buffers, but not rejecting out-of-range writes (small buf or large offset). A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

uuid
IBM Cloud Transformation Advisor
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Decision Optimization for Cloud Pak for Data
Maximo Application Suite - Visual Inspection Component
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Application Modernization Accelerator
InfoSphere Optim Archive Viewer
IBM App Connect Enterprise

Install updates from vendor's website.

uuid - addressed in versions 11.1.1, 12.0.1, 13.0.1
IBM Cloud Transformation Advisor - update to 5.0.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.20, 9.1.17
IBM App Connect Enterprise - addressed in versions 12.0.12.27, 13.0.8.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq

• Out-of-bounds write in uuid
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• IBM InfoSphere Optim Archive Viewer update for uuid
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• IBM Watson Discovery Cartridge update for uuid
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for uuid
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM App Connect Enterprise