IBM WATSON SPEECH SERVICES CARTRIDGE · CVE-2026-17493 · Runtime
FIX → 5.4.0 Patch 8 ✓ verified
IBM says the Unpacker in the Watson Speech Services Cartridge can be driven by untrusted external input. If the Unpacker is reused after an error, the process can crash with a SEGV from an out-of-bounds read. IBM fixed it in 5.4.0 Patch 8, and the fix applies to all affected versions (4.0.0 to 5.4.0). IBM lists no workarounds.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 on Cloud Pak for Data are affected. IBM's CVSS vector shows network access with no privileges or user interaction needed, and says untrusted external input can trigger it. Impact is a crash (availability only). Teams not running this cartridge can skip it.
Who cares cloud-pak-for-data, ibm-watson, speech-services
4.0.0 to 5.4.0 without Patch 8 is affectedIBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 5.4.0 Patch 8
5.4.0 Patch 84.0.0-5.4.0)