---
id: "CVE-2026-82418"
kind: "vulnerability"
aliases: ["CVE-2026-82418"]
title: "IBM Watson Speech Services Cartridge: use-after-free lets remote attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM Watson Speech Services Cartridge", "fixed": ["5.4.0 Patch 8"], "affected": ">= 4.0.0, <= 5.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cloud-pak-for-data", "ibm-watson", "openssl", "self-hosted", "speech-services", "vendor"]
not_affected_if: []
published_at: "2026-11-04T21:18:14+00:00"
first_seen_at: "2026-11-04T21:49:23+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82418", "first_seen_at": "2026-11-04T21:49:23+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418", "first_seen_at": "2026-11-04T21:51:04+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418"]}]
exploit_sources: []
---

# IBM Watson Speech Services Cartridge: use-after-free lets remote attacker run code

IBM says Watson Speech Services Cartridge 4.0.0 through 5.4.0 is affected by a use-after-free in the OpenSSL bundled in the cryptography wheels (versions before 48.01) used by its Speech runtimes. Specially crafted PKCS#7 or S/MIME signed messages can trigger it during signature verification. IBM rates it 9.8 (network, no authentication, no user interaction) and says a remote attacker could execute arbitrary code. IBM lists no workarounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Watson Speech Services Cartridge affected >= 4.0.0, <= 5.4.0 fixed 5.4.0 Patch 8

## How to check

Check whether you run IBM Watson Speech Services Cartridge (Cloud Pak for Data) at a version from 4.0.0 to 5.4.0 without 5.4.0 Patch 8. If your installed cartridge is not at 5.4.0 Patch 8, treat it as exposed.

## Fix

Install IBM Watson Speech Services Cartridge 5.4.0 Patch 8 (IBM says it applies to all versions 4.0.0-5.4.0): https://www.ibm.com/docs/en/cloud-paks/cp-data/5.4.x

## Timeline

- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82418
- 2026-11-04T21:51:04+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418 — Read IBM bulletin (published 2026-10-22): cause is OpenSSL in cryptography wheels before 48.01 (PKCS#7/S/MIME verify UAF); fix 5.4.0 Patch 8 covers 4.0.0-5.4.0; no workarounds. No exploitation or PoC found; X not searched (not needed).

## Documents

- [advisory] IBM Security Bulletin CVE-2026-82418 Watson Speech Services Cartridge https://www.ibm.com/support/pages/security-bulletin-ibm-watson-speech-services-cartridge-vulnerable-use-after-free-condition-cryptography-wheels-openssl-cve-2026-82418

## From the sources

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_