CVE-2026-6794 Multiple Vulnerabilities in IBM Concert Software

High 7.8 Published 23 Sep 2026 Updated 25 Sep 2026

A local attacker can exploit a double free vulnerability in IBM Concert to corrupt heap memory and execute arbitrary code.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-6794?

CVE-2026-6794 is a high-severity use after free vulnerability in Ibm Concert, published on 23 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.

Weakness: CWE-415

Which versions are affected by CVE-2026-6794?

It affects 1 product.

Products include Ibm Concert.

How do I fix CVE-2026-6794?

No fix has been published for CVE-2026-6794 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-6794 being exploited?

There is no known exploitation of CVE-2026-6794 in the wild and no public exploit code.

All Ibm Concert vulnerabilities

Sources

Also known as GHSA-2vvc-x872-gvjq.