CVE-2026-17493

A decoding error could crash the Watson Speech runtime

IBM · Watson Speech Services Cartridge / runtime unpacker

First documented disclosure · Review checkpoint

Summary

Untrusted input could cause a speech runtime to crash when it reused a decoder after an error.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report exploitation in the wild.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The unpacker could read beyond its valid memory after an earlier decoding failure.

Conditions required

The runtime processes external input and uses the affected unpacker again after an error. IBM’s CVSS vector requires no privileges or additional user interaction.

Potential impact

A process failure could interrupt speech service. IBM identifies an availability impact.

Affected versions and configurations

4.0.0 through 5.4.0.

Fix and mitigation status

5.4.0 Patch 8.

Practical next steps

Apply IBM’s 5.4.0 Patch 8 to the affected cartridge.

Operating lesson

Discard decoder state after an unrecoverable input error.

Evidence and limits

IBM’s October 22 bulletin identifies the unpacker as part of the speech runtime.

Sources