{"id":"CVE-2026-82418","kind":"vulnerability","aliases":["CVE-2026-82418"],"related":[],"title":"IBM Watson Speech Services Cartridge: use-after-free lets remote attacker run code","description":"IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.","summary":"IBM says Watson Speech Services Cartridge 4.0.0 through 5.4.0 is affected by a use-after-free in the OpenSSL bundled in the cryptography wheels (versions before 48.01) used by its Speech runtimes. Specially crafted PKCS#7 or S/MIME signed messages can trigger it during signature verification. IBM rates it 9.8 (network, no authentication, no user interaction) and says a remote attacker could execute arbitrary code. IBM lists no workarounds.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Watson Speech Services Cartridge","fixed":["5.4.0 Patch 8"],"affected":">= 4.0.0, <= 5.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-watson","openssl","self-hosted","speech-services","vendor"],"not_affected_if":[],"how_to_check":"Check whether you run IBM Watson Speech Services Cartridge (Cloud Pak for Data) at a version from 4.0.0 to 5.4.0 without 5.4.0 Patch 8. If your installed cartridge is not at 5.4.0 Patch 8, treat it as exposed.","fix":"Install IBM Watson Speech Services Cartridge 5.4.0 Patch 8 (IBM says it applies to all versions 4.0.0-5.4.0): https://www.ibm.com/docs/en/cloud-paks/cp-data/5.4.x","status":"open","published_at":"2026-11-04T21:18:14+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","triaged_at":"2026-11-04T21:50:30+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-04T21:50:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM Watson Speech Services Cartridge: use-after-free lets remote attacker run code","impact":"high","summary":"IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free memory bug. A remote attacker can exploit it to execute arbitrary code on the affected system.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-watson","speech-services","cloud-pak-for-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker executes arbitrary code on the server","analyst_note":"Check IBM's security bulletin for affected versions, fixed release, and whether the flaw needs authentication or a specific configuration.","how_to_check":"- Check whether your deployment runs IBM Watson Speech Services Cartridge and which version it is, within `4.0.0` to `5.4.0`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 on Cloud Pak for Data or similar platforms are in scope. The sources do not say which deployment paths or configurations are exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000675,"input_tokens":4102,"output_tokens":529,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for affected versions, fixed release, and whether the flaw needs authentication or a specific configuration.","search":"'-2026':16A,19A '-82418':17A,20A '4.0.0':48B,117C '48.01':69B '5.4.0':50B,119C '7':78B '9.8':92B 'affect':52B 'allow':121C 'arbitrari':106B,127C 'attack':12A,103B,124C 'authent':95B 'bundl':62B 'cartridg':5A,47B,116C 'cartridge':25A 'cloud':27B 'cloud-pak-for-data':26B 'code':14A,107B,128C 'could':104B,120C 'craft':76B 'cryptographi':65B 'cve':15A,18A 'data':30B 'due':129C 'execut':105B,126C 'free':9A,58B,135C 'host':37B 'ibm':1A,21A,32B,42B,89B,108B,112C 'ibm-watson':31B 'interact':98B 'let':10A 'list':109B 'messag':82B 'network':93B 'openssl':34B,61B 'pak':28B 'pkcs':77B 'rate':90B 'remot':11A,102B,123C 'run':13A 'runtim':74B 's/mime':80B 'say':43B,100B 'self':36B 'self-host':35B 'servic':4A,40B,46B,115C 'services':24A 'sign':81B 'signatur':87B 'special':75B 'speech':3A,23A,39B,45B,73B,114C 'speech-servic':38B 'trigger':84B 'use':7A,56B,70B,133C 'use-after-fre':6A,55B,132C 'user':97B 'vendor':41B 'verif':88B 'version':67B 'vulner':136C 'watson':2A,22A,33B,44B,113C 'wheel':66B 'workaround':111B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 on Cloud Pak for Data or similar platforms are in scope. The sources do not say which deployment paths or configurations are exposed, so unknown.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:51:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","run_id":1708},"products":{"at":"2026-11-04T21:51:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","run_id":1708},"workarounds":{"at":"2026-11-04T21:51:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","run_id":1708},"how_to_check":{"at":"2026-11-04T21:51:04Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","run_id":1708}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmwatsonspeechservicescartridge","watsonspeechservicescartridge"],"ptokens":["cartridge","ibm","services","speech","watson"],"labels":["cloudpakfordata","critical","ibmwatson","openssl","selfhosted","speechservices","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82418","severity":null,"published_at":"2026-11-04T21:18:14+00:00","modified_at":"2026-11-04T21:18:15+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","fetched_at":"2026-11-04T21:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82418:1708","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","severity":null,"published_at":"2026-11-04T21:51:04+00:00","modified_at":"2026-11-04T21:51:04+00:00","first_seen_at":"2026-11-04T21:51:04+00:00","fetched_at":"2026-11-04T21:51:04+00:00","note":"Read IBM bulletin (published 2026-10-22): cause is OpenSSL in cryptography wheels before 48.01 (PKCS#7/S/MIME verify UAF); fix 5.4.0 Patch 8 covers 4.0.0-5.4.0; no workarounds. No exploitation or PoC found; X not searched (not needed).","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418"]}],"documents":[{"id":70868,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418","title":"IBM Security Bulletin CVE-2026-82418 Watson Speech Services Cartridge","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}