Always-Incorrect Control Flow Implementation in uuid - CVE-2026-41988

Vulnerability identifier: #VU132377

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2026-41988

CWE-ID: CWE-670

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to modify data on the system.

The vulnerability exists due to uuid can make unexpected writes when external output buffers are used. A local user can gain unauthorized access to modify data on the system.

uuid
IBM Cloud Transformation Advisor
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Maximo Application Suite - Manage Component
IBM Decision Optimization for Cloud Pak for Data
Storage Defender Copy Data Management
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite Ai Service
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Application Modernization Accelerator
IBM App Connect Enterprise

Install updates from vendor's website.

uuid - addressed in versions 11.1.1, 12.0.1, 13.0.1
IBM Cloud Transformation Advisor - update to 5.0.0
Storage Defender Copy Data Management - update to 2.3.1.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.21-sc2, 4.3.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.20, 9.1.17
Maximo Application Suite Ai Service - update to 9.1.15
IBM App Connect Enterprise - addressed in versions 12.0.12.27, 13.0.8.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34
• https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq

• Always-Incorrect Control Flow Implementation in uuid
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• Multiple vulnerabilities in IBM Maximo AI Service
• IBM Maximo Application Suite - Manage Component update for uuid
• IBM Watson Discovery Cartridge update for uuid
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Defender Copy Data Management
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for uuid
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM App Connect Enterprise