Cyber Resilience

CVE-2025-1719

Medium

Published: 20 January 2026

Published
20 January 2026
Modified
26 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0007 21.4th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1719 is a medium-severity Heap Inspection (CWE-244) vulnerability in Ibm Concert. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and PE-19 (Information Leakage).

Deeper analysis

IBM Concert versions 1.0.0 through 2.1.0 are affected by CVE-2025-1719, a vulnerability stemming from improper clearing of heap memory (CWE-244). This flaw could allow a remote attacker to obtain sensitive information from allocated memory. The vulnerability received a CVSS v3.1 base score of 5.9, reflecting medium severity with high confidentiality impact.

A remote attacker with no privileges or user interaction required can exploit this over the network, though it demands high attack complexity. Successful exploitation enables disclosure of sensitive data from heap memory without impacting integrity or availability, and the scope remains unchanged.

IBM has published an advisory with details on mitigation at https://www.ibm.com/support/pages/node/7257006.

EU & UK References

Vulnerability details

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.

CWE(s)
CWE-244

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Remote heap memory disclosure in a server application directly enables T1190 for initial exploitation and T1552 for potential extraction of credentials or secrets from process memory.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-1722Same product: Ibm Concert
CVE-2024-49354Same product: Ibm Concert
CVE-2025-64647Same product: Ibm Concert
CVE-2025-33089Same product: Ibm Concert
CVE-2025-33015Same product: Ibm Concert
CVE-2024-52367Same product: Ibm Concert
CVE-2024-43178Same product: Ibm Concert
CVE-2024-27256Same vendor: Ibm
CVE-2025-36253Same product: Ibm Concert
CVE-2026-8633Same vendor: Ibm

Affected Assets

ibm
concert
1.0.0 — 2.2.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-4 Information in Shared System Resources good match
prevent

Directly requires the system to prevent unauthorized transfer of sensitive information remaining in shared heap memory after deallocation.

SI-16 Memory Protection partial match
prevent

Implements memory protection safeguards that can enforce clearing or isolation of sensitive data in allocated heap regions.

PE-19 Information Leakage partial match
prevent

Requires procedures to prevent leakage of sensitive information from system memory allocations.

References