IBM Semeru Runtime up to 8.0.442.0/11.0.26.0/17.0.14.0/21.0.6.0 AES CBC heap-based overflow

Summaryinfo

A vulnerability was found in IBM Semeru Runtime up to 8.0.442.0/11.0.26.0/17.0.14.0/21.0.6.0 and classified as critical. Affected is an unknown function of the component AES CBC. Executing a manipulation can lead to heap-based overflow. This vulnerability is handled as CVE-2025-2900. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in IBM Semeru Runtime up to 8.0.442.0/11.0.26.0/17.0.14.0/21.0.6.0 and classified as critical. This vulnerability affects an unknown code of the component AES CBC. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability. CVE summarizes:

IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation.

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2025-2900 since 03/28/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/14/2025).

The vulnerability scanner Nessus provides a plugin with the ID 237832 (RHEL 10 : java-21-ibm-semeru-certified-jdk update (Moderate) (RHSA-2025:8063)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (237832) and CERT Bund (WID-SEC-2025-1056). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM Maximo Asset Management
• IBM DB2
• IBM InfoSphere Information Server
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• IBM SPSS
• HCL Commerce
• IBM Business Automation Workflow
• IBM Security Guardium
• IBM MQ
• IBM Power Hardware Management Console
• IBM Rational Business Developer
• IBM InfoSphere Identity Insight
• IBM Tivoli Monitoring
• IBM Semeru Runtime
• IBM Integration Bus
• IBM DataPower Gateway
• IBM App Connect Enterprise
• IBM License Metric Tool
• IBM Security Verify Access
• IBM TXSeries
• IBM Sterling Connect:Direct
• IBM Tivoli Business Service Manager
• HCL BigFix

Productinfo

Vendor

• IBM

Name

• Semeru Runtime

Version

• 8.0.442
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21
• 11.0.22
• 11.0.23
• 11.0.24
• 11.0.25
• 11.0.26.0
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4
• 17.0.5
• 17.0.6
• 17.0.7
• 17.0.8
• 17.0.9
• 17.0.10
• 17.0.11
• 17.0.12
• 17.0.13
• 17.0.14.0
• 21.0.0
• 21.0.1
• 21.0.2
• 21.0.3
• 21.0.4
• 21.0.5
• 21.0.6.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion