CVE-2026-82418

Signed-message verification could corrupt memory in Watson Speech

IBM · Watson Speech Services Cartridge / cryptographic verification

First documented disclosure · Review checkpoint

Summary

IBM reports potential code execution in its speech runtime through an affected OpenSSL component.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report exploitation in the wild.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The cryptography package bundled with the runtime could access freed memory during verification of a signed message.

Conditions required

Untrusted signed content must reach the vulnerable verification operation. IBM’s CVSS vector requires no application credentials or user interaction.

Potential impact

IBM assesses possible code execution with high confidentiality, integrity and availability impact.

Affected versions and configurations

4.0.0 through 5.4.0.

Fix and mitigation status

5.4.0 Patch 8.

Practical next steps

Install IBM’s 5.4.0 Patch 8 for the cartridge.

Operating lesson

Include cryptographic libraries bundled with the speech runtime in dependency and patch inventories.

Evidence and limits

IBM identifies the affected verification component. Its bulletin does not name a specific internet-facing speech endpoint.

Sources