Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-08T13:17:16.610Z",
  "pubdate": "2026-10-08T13:17:16.610Z",
  "executiveSummary": "A critical remote code execution vulnerability exists in IBM DataPower Gateway, affecting versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2.\nThe vulnerability is rooted in an out-of-bounds write security flaw within the gateway's RFC2047 encoded-word parser component. A remote, unauthenticated attacker can exploit this weakness by transmitting crafted input that triggers memory corruption during parsing operations.\nGiven the gateway's role as an integration and security proxy handling enterprise API and web traffic, successful exploitation of this vulnerability yields severe consequences, enabling the remote execution of arbitrary code with the privileges of the gateway process.\nThis compromises the integrity, confidentiality, and availability of the gateway and its mediated services. Organizations utilizing the affected versions of IBM DataPower Gateway face significant risk, as the vulnerability does not require local access or system privileges to exploit.\nImmediate remediation, including upgrading to patched firmware releases and implementing strict network and application-level controls, is strongly advised to defend against potential exploitation attempts targeting this parsing flaw.",
  "technicalDetails": "The technical core of this vulnerability resides within the RFC2047 encoded-word parser integrated into IBM DataPower Gateway. RFC2047 specifies a standard protocol for representing non-ASCII text within message headers (such as email or HTTP headers) using a specific encoded-word syntax, typically structured as '=?charset?encoding?encoded-text?='. During processing, the parser must decode the encoded-text segment (using methods like Base64 or Quoted-Printable) back into raw binary or UTF-8 characters.\nThe root cause of this vulnerability is an out-of-bounds write condition that occurs during this decoding process. When the parser encounters a maliciously structured encoded-word payload, it fails to perform adequate boundary verification on the target buffer allocation relative to the length of the decoded output. An attacker can construct a payload where the declared encoding or the sequence of characters mismatch the actual decoded output length, or exploit flaws in how the parser calculates the memory size required for the decoded data.\nConsequently, the decoded payload overflows the pre-allocated destination heap or stack buffer, writing raw data directly into adjacent, unallocated, or critical memory spaces.\nThe attack flow begins with a remote attacker sending a specially crafted protocol request (such as an HTTP request or MIME-encapsulated message) containing the malicious RFC2047 encoded-word string in a processed header. Since the IBM DataPower Gateway actively inspects and parses incoming traffic headers to perform security filtering, routing, or transformations, the gateway automatically passes the input to the vulnerable RFC2047 parsing component. No authentication or elevated privileges are required to initiate this parsing sequence.\nAs the component processes the header, the out-of-bounds write corrupts critical control data structures, such as function pointers or return addresses. By carefully structuring the written data, the attacker can hijack the program's execution flow, leading to arbitrary code execution within the execution context of the DataPower Gateway process.\nThe affected versions include IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Post-exploitation impact is maximum, granting the adversary complete control over the gateway, allowing traffic interception, credential theft, and potential lateral movement into internal networks."
}