CVE-2026-82418

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
IBM	Watson Speech Services Cartridge	>= 4.0.0, <= 5.4.0

References

https://www.ibm.com/support/pages/node/7293510Vendor Advisory

Timeline

Published: Nov 4, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-82423.7A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the compo CVE-2026-824216.3A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages CVE-2026-824226.3A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_d CVE-2026-824235.4A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of CVE-2026-824246.3A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-824257.5A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in d CVE-2026-824266.5Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and ope CVE-2026-824277.8Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That CVE-2026-824288.8Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate,CVE-2026-824297.8Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS a CVE-2026-82435.3A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNL CVE-2026-824307.8Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory