CVE-2026-82418 is a critical (CVSS 9.8) use-after-free vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 that could let a remote attacker execute arbitrary code.
What Is It
CVE-2026-82418 is a memory-safety flaw in IBM Watson Speech Services Cartridge, classified as CWE-416 (Use After Free). According to the description IBM PSIRT submitted to NVD, the vulnerability "could allow a remote attacker to execute arbitrary code."
NVD published the record on 2026-11-04. Its status is "Awaiting Analysis," so NVD has not yet independently scored or enriched it. The CVSS data below comes from IBM as the CNA.
Why It Matters
IBM's CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That is a base score of 9.8 (CRITICAL). In practice this means:
- Network-reachable: an attacker can exploit it remotely.
- Low attack complexity: it needs no special conditions.
- No privileges required: the attacker does not need to log in.
- No user interaction: no victim has to take any action.
- High impact on confidentiality, integrity and availability: a successful attack could compromise the affected system completely.
Remote code execution with no authentication and no user interaction is the worst case for exposed services.
Exploitation status: The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. The supplied sources do not confirm active exploitation in the wild, and they do not give a CISA-mandated remediation deadline.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | Watson Speech Services Cartridge | 4.0.0 through 5.4.0 (inclusive) |
IBM lists CPEs for the start and end of the range:
cpe:2.3:a:ibm:watson_speech_services_cartridge:4.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:watson_speech_services_cartridge:5.4.0:*:*:*:*:*:*:*
Any deployment running a version from 4.0.0 up to and including 5.4.0 should be treated as affected.
Patch Status
The NVD record does not name a fixed version or a specific remediation. IBM has published a support bulletin for this issue, linked below. Administrators should:
- Review the IBM bulletin for fixed versions and remediation guidance.
- Find every Watson Speech Services Cartridge deployment running 4.0.0 through 5.4.0.
- Apply IBM's fix as a priority, given the critical, unauthenticated, network-exploitable profile.
- Limit network exposure of affected services until they are patched.
Because CISA has not added this CVE to KEV, no federal required-action deadline currently applies.
Sources
- NVD: CVE-2026-82418
- IBM Security Bulletin (Node 7293510)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)