{"id":"CVE-2026-19319","kind":"vulnerability","aliases":["CVE-2026-19319"],"related":[],"title":"IBM Watson Speech Services Cartridge leaks memory contents to remote attackers","description":"IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.","summary":"IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain an out-of-bounds read. A remote attacker can use it to obtain sensitive information from the service's memory.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-watson","speech-services","vendor"],"not_affected_if":[],"how_to_check":"- Check whether the Watson Speech Services Cartridge is installed and which version it runs, within the range `4.0.0` to `5.4.0`","fix":null,"status":"open","published_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","triaged_at":"2026-11-04T21:51:26+00:00","updated_at":"2026-11-04T21:51:26+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-04T21:51:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM Watson Speech Services Cartridge leaks memory contents to remote attackers","impact":"medium","summary":"IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain an out-of-bounds read. A remote attacker can use it to obtain sensitive information from the service's memory.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-watson","speech-services","cloud-pak-for-data"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads sensitive information from service memory","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version, affected deployment details and whether authentication is required; NVD text alone does not say.","how_to_check":"- Check whether the Watson Speech Services Cartridge is installed and which version it runs, within the range `4.0.0` to `5.4.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 in their IBM Cloud Pak for Data environment are the ones exposed. The sources do not say which deployment configurations or features are required to reach the flaw. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4098,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19319':14A,17A '-2026':13A,16A '4.0.0':36B,66C '5.4.0':38B,68C 'allow':70C 'attack':11A,48B,73C 'bound':44B,84C 'cartridg':5A,34B,65C 'cloud':19B 'cloud-pak-for-data':18B 'contain':39B 'content':8A 'could':69C 'cve':12A,15A 'data':22B 'due':78C 'ibm':1A,24B,30B,61C 'ibm-watson':23B 'inform':55B,77C 'leak':6A 'memori':7A,60B 'obtain':53B,75C 'out-of-bound':41B,81C 'pak':20B 'read':45B,85C 'remot':10A,47B,72C 'sensit':54B,76C 'servic':4A,28B,33B,58B,64C 'speech':3A,27B,32B,63C 'speech-servic':26B 'use':50B 'vendor':29B 'version':35B 'watson':2A,25B,31B,62C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 in their IBM Cloud Pak for Data environment are the ones exposed. The sources do not say which deployment configurations or features are required to reach the flaw. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","ibmwatson","medium","speechservices","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19319","severity":null,"published_at":"2026-11-04T21:18:13+00:00","modified_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","fetched_at":"2026-11-04T21:49:23+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}