CVE-2026-85457

HighCVSS 8.1/10Last modified Oct 16, 2026

Description

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-854582.1Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.CVE-2026-85465.3Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the rendCVE-2026-854698.0A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` uCVE-2026-85477.5Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromisCVE-2026-854716.4A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading toCVE-2026-854735.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range valCVE-2026-854757.2A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by inteCVE-2026-854768.2Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: CVE-2026-854783.5A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface witCVE-2026-854795.3The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticatedCVE-2026-85488.3Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to CVE-2026-854836.3Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thri
CVE-2026-85457: High severity, CVSS 8.1 | Vulnix