{"id":"CVE-2026-17493","kind":"vulnerability","aliases":["CVE-2026-17493"],"related":[],"title":"IBM Watson Speech Services: out-of-bounds read lets a remote attacker crash service","description":"IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.","summary":"IBM says the Unpacker in the Watson Speech Services Cartridge can be driven by untrusted external input. If the Unpacker is reused after an error, the process can crash with a SEGV from an out-of-bounds read. IBM fixed it in 5.4.0 Patch 8, and the fix applies to all affected versions (4.0.0 to 5.4.0). IBM lists no workarounds.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Watson Speech Services Cartridge","fixed":["5.4.0 Patch 8"],"affected":">= 4.0.0, <= 5.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-watson","runtime","speech-services"],"not_affected_if":[],"how_to_check":"Check which Watson Speech Services Cartridge version is installed in your Cloud Pak for Data cluster. Any version from 4.0.0 to 5.4.0 without Patch 8 is affected. The Unpacker is part of the Speech runtimes.","fix":"Install Watson Speech Services Cartridge 5.4.0 Patch 8. IBM says it applies to all affected versions (4.0.0-5.4.0). Download and install from https://www.ibm.com/docs/en/cloud-paks/cp-data/5.4.x","status":"open","published_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","triaged_at":"2026-11-04T21:50:48+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-04T21:50:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Watson Speech Services: out-of-bounds read lets a remote attacker crash service","impact":"low","summary":"IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain an out-of-bounds read. A remote attacker can trigger it to cause a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-watson","cloud-pak-for-data","speech-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker crashes the speech service, causing denial of service","analyst_note":"Find the IBM security bulletin for CVE-2026-17493 to confirm the fixed version, the affected deployment paths, and whether authentication is needed.","how_to_check":"- Check whether the IBM Watson Speech Services Cartridge is deployed, and at which version, in your Cloud Pak for Data installation\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 are exposed. The sources do not say which deployment paths or configurations make the service reachable, so whether internal-only deployments are at risk is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4096,"output_tokens":512,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17493 to confirm the fixed version, the affected deployment paths, and whether authentication is needed.","search":"'-17493':18A,21A '-2026':17A,20A '4.0.0':93B,105C '5.4.0':82B,95B,107C '8':84B 'affect':91B 'allow':109C 'appli':88B 'attack':13A,112C 'bound':8A,76B,125C 'cartridg':48B,104C 'cartridge':26A 'caus':114C 'cloud':28B 'cloud-pak-for-data':27B 'could':108C 'crash':14A,67B 'cve':16A,19A 'data':31B 'denial':116C 'driven':51B 'due':119C 'error':63B 'extern':54B 'fix':79B,87B 'ibm':1A,22A,33B,39B,78B,96B,100C 'ibm-watson':32B 'input':55B 'let':10A 'list':97B 'out-of-bound':5A,73B,122C 'pak':29B 'patch':83B 'process':65B 'read':9A,77B,126C 'remot':12A,111C 'reus':60B 'runtim':35B 'say':40B 'segv':70B 'servic':4A,15A,38B,47B,103C,118C 'services':25A 'speech':3A,24A,37B,46B,102C 'speech-servic':36B 'unpack':42B,58B 'untrust':53B 'version':92B 'watson':2A,23A,34B,45B,101C 'workaround':99B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 on Cloud Pak for Data are affected. IBM's CVSS vector shows network access with no privileges or user interaction needed, and says untrusted external input can trigger it. Impact is a crash (availability only). Teams not running this cartridge can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:52:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","run_id":1713},"products":{"at":"2026-11-04T21:52:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","run_id":1713},"workarounds":{"at":"2026-11-04T21:52:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","run_id":1713},"how_to_check":{"at":"2026-11-04T21:52:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","run_id":1713},"who_affected":{"at":"2026-11-04T21:52:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","run_id":1713}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmwatsonspeechservicescartridge","watsonspeechservicescartridge"],"ptokens":["cartridge","ibm","services","speech","watson"],"labels":["cloudpakfordata","high","ibmwatson","runtime","speechservices"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17493","severity":null,"published_at":"2026-11-04T21:18:13+00:00","modified_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","fetched_at":"2026-11-04T21:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17493:1713","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","severity":null,"published_at":"2026-11-04T21:52:33+00:00","modified_at":"2026-11-04T21:52:33+00:00","first_seen_at":"2026-11-04T21:52:33+00:00","fetched_at":"2026-11-04T21:52:33+00:00","note":"Read IBM bulletin (published 2026-10-22): affected 4.0.0-5.4.0, fix 5.4.0 Patch 8 applies to all listed versions, no workarounds. PR:N so unauthenticated. No exploitation or PoC found; did not search social.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493"]}],"documents":[{"id":70876,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493","title":"IBM Security Bulletin: Watson Speech Services Cartridge D.O.S. in Unpacker (CVE-2026-17493)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}