{"id":"CVE-2026-82118","kind":"vulnerability","aliases":["CVE-2026-82118"],"related":[],"title":"HiRDB database server: stack buffer overflow allows remote code execution","description":"Stack-based Buffer Overflow Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.","summary":"HiRDB, a Hitachi relational database server, has a stack-based buffer overflow in several version 9 and version 10 lines. The sources do not state the attacker's exact capability, but a stack overflow in a network-facing database server is typically exploitable to run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-server","hirdb","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, Version 9 through `09-66-22`, and the Additional Function and Version 9(32) variants listed in the advisory.\n- unknown for other checks: the sources do not describe a configuration file or command to confirm exposure.","fix":"- Move HiRDB Server Version 10 to `10-12-01` or later, per the advisory.\n- Version 9 installations need the vendor's fixed release; the sources do not name a version for the 9.x line.","status":"open","published_at":"2026-10-27T10:16:55+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:34+00:00","updated_at":"2026-10-27T10:31:34+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T10:31:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move HiRDB Server Version 10 to `10-12-01` or later, per the advisory.\n- Version 9 installations need the vendor's fixed release; the sources do not name a version for the 9.x line.","reach":"unknown","title":"HiRDB database server: stack buffer overflow allows remote code execution","impact":"high","summary":"HiRDB, a Hitachi relational database server, has a stack-based buffer overflow in several version 9 and version 10 lines. The sources do not state the attacker's exact capability, but a stack overflow in a network-facing database server is typically exploitable to run code on the server.","category":"other","nicknames":[],"who_cares":["hirdb","database-server","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may run code on the database server","analyst_note":"Find the vendor advisory from Hitachi for CVE-2026-82118 to confirm the vulnerable entry point, required access, fixed version for the 9.x line, and whether it is exploited.","how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, Version 9 through `09-66-22`, and the Additional Function and Version 9(32) variants listed in the advisory.\n- unknown for other checks: the sources do not describe a configuration file or command to confirm exposure.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running HiRDB Server in the listed version ranges, including Version 10 before 10-12-01 and the 9.x lines through 09-66-22 and their Additional Function and 9(32) variants. The sources do not say whether the flaw needs a network path, an account, or a non-default setting, so check reachability of the database port before deciding urgency.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000666,"input_tokens":3384,"output_tokens":656,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':93C,104C,118C,145C '-01':97C '-02':130C '-12':96C '-2026':12A,15A '-22':108C,134C '-66':107C,121C,133C,148C '-82118':13A,16A '/v':122C,149C '09':103C,106C,117C,120C,129C,132C,144C,147C '10':44B,90C,92C,95C '32':127C,142C '9':41B,101C,115C,126C,141C 'addit':112C,138C 'affect':86C 'allow':7A 'attack':52B 'base':35B,78C 'buffer':5A,36B,79C 'capabl':55B 'code':9A,72B 'cve':11A,14A 'databas':2A,18B,29B,65B 'database-serv':17B 'exact':54B 'execut':10A 'exploit':69B 'face':64B 'function':113C,139C 'hirdb':1A,20B,25B,83C,87C,98C,109C,123C,135C 'hitachi':27B 'host':24B 'issu':85C 'line':45B 'network':63B 'network-fac':62B 'overflow':6A,37B,59B,80C 'relat':28B 'remot':8A 'run':71B 'self':23B 'self-host':22B 'server':3A,19B,30B,66B,75B,88C,99C,110C,124C,136C 'sever':39B 'sourc':47B 'stack':4A,34B,58B,77C 'stack-bas':33B,76C 'state':50B 'typic':68B 'version':40B,43B,89C,100C,114C,125C,140C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running HiRDB Server in the listed version ranges, including Version 10 before 10-12-01 and the 9.x lines through 09-66-22 and their Additional Function and 9(32) variants. The sources do not say whether the flaw needs a network path, an account, or a non-default setting, so check reachability of the database port before deciding urgency.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82118","severity":null,"published_at":"2026-10-27T10:16:55+00:00","modified_at":"2026-10-27T10:16:55+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}