CVE-2026-8179

Vulnerability

A buffer overflow vulnerability exists in the asperahttpd component of IBM Aspera High-Speed Transfer Endpoint versions 3.7.4 through 4.4.7 Fix Pack 1, and IBM Aspera High-Speed Transfer Server versions 3.7.4 through 4.4.7 Fix Pack 1. This is a heap-based buffer overflow (CWE-122) [1]. The vulnerability can be triggered when the component receives specially crafted input from an authenticated user.

Exploitation

An attacker must be an authenticated user of the Aspera system. No special privileges beyond standard authentication are indicated as required. The attacker sends crafted data to the asperahttpd component, which triggers the buffer overflow. No user interaction from other parties is required, and the attack is performed over the network.

Impact

Successful exploitation allows the authenticated attacker to execute arbitrary code on the server with the privileges of the asperahttpd process. This can lead to full compromise of the system's confidentiality, integrity, and availability. The CVSS v3 base score is 8.8, indicating high severity.

Mitigation

The vulnerability is fixed in IBM Aspera High-Speed Transfer Endpoint 4.4.7 Fix Pack 2 and IBM Aspera High-Speed Transfer Server 4.4.7 Fix Pack 2, released as per the security bulletin [1]. Users should apply the fix pack or upgrade to these versions immediately. No workarounds are mentioned in the available references.