---
id: "CVE-2026-17493"
kind: "vulnerability"
aliases: ["CVE-2026-17493"]
title: "IBM Watson Speech Services: out-of-bounds read lets a remote attacker crash service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "IBM Watson Speech Services Cartridge", "fixed": ["5.4.0 Patch 8"], "affected": ">= 4.0.0, <= 5.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cloud-pak-for-data", "ibm-watson", "runtime", "speech-services"]
not_affected_if: []
published_at: "2026-11-04T21:18:13+00:00"
first_seen_at: "2026-11-04T21:49:23+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17493", "first_seen_at": "2026-11-04T21:49:23+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493", "first_seen_at": "2026-11-04T21:52:33+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493"]}]
exploit_sources: []
---

# IBM Watson Speech Services: out-of-bounds read lets a remote attacker crash service

IBM says the Unpacker in the Watson Speech Services Cartridge can be driven by untrusted external input. If the Unpacker is reused after an error, the process can crash with a SEGV from an out-of-bounds read. IBM fixed it in 5.4.0 Patch 8, and the fix applies to all affected versions (4.0.0 to 5.4.0). IBM lists no workarounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Watson Speech Services Cartridge affected >= 4.0.0, <= 5.4.0 fixed 5.4.0 Patch 8

## How to check

Check which Watson Speech Services Cartridge version is installed in your Cloud Pak for Data cluster. Any version from 4.0.0 to 5.4.0 without Patch 8 is affected. The Unpacker is part of the Speech runtimes.

## Fix

Install Watson Speech Services Cartridge 5.4.0 Patch 8. IBM says it applies to all affected versions (4.0.0-5.4.0). Download and install from https://www.ibm.com/docs/en/cloud-paks/cp-data/5.4.x

## Timeline

- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17493
- 2026-11-04T21:52:33+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493 — Read IBM bulletin (published 2026-10-22): affected 4.0.0-5.4.0, fix 5.4.0 Patch 8 applies to all listed versions, no workarounds. PR:N so unauthenticated. No exploitation or PoC found; did not search social.

## Documents

- [advisory] IBM Security Bulletin: Watson Speech Services Cartridge D.O.S. in Unpacker (CVE-2026-17493) https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-dos-unpacker-cve-2026-17493

## From the sources

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_