Cyber Resilience

CVE-2025-64646

Ibm Concert 1.0.0 – 2.2.0

Published
25 March 2026
Modified
26 March 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0017 7th percentile
Risk Priority 46 floored blend · peak EPSS

Summary

CVE-2025-64646 is a medium-severity Compiler Removal of Code to Clear Buffers (CWE-14) vulnerability in Ibm Concert. Its CVSS base score is 6.2 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

IBM Concert 1.0.0 through 2.2.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

CWE(s)
CWE-14

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-1721Same product: Ibm Concert
CVE-2025-33101Same product: Ibm Concert
CVE-2025-1722Same product: Ibm Concert
CVE-2025-1719Same product: Ibm Concert
CVE-2025-33100Same product: Ibm Concert
CVE-2025-1759Same product: Ibm Concert
CVE-2025-33089Same product: Ibm Concert
CVE-2024-49827Same product: Ibm Concert
CVE-2024-49354Same product: Ibm Concert
CVE-2025-36440Same product: Ibm Concert

Affected Assets

ibm
concert
1.0.0 — 2.2.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation can include static analysis or binary inspection that reveals compiler removal of buffer-clearing stores.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles applied during design and implementation can mandate use of volatile qualifiers, explicit_bzero, or similar techniques that survive dead-store elimination.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices include compiler-aware mitigations (volatile, memset_s) that prevent this exact weakness.

PR.DS-10 mostly match
prevents

Explicitly requires removing confidential data from process memory when no longer needed, directly addressing dead-store removal of buffer clears.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect residual sensitive data left by dead-store removal, but does not prevent the weakness itself.

A.8.25 Secure development life cycle partial match
prevents

A secure SDLC can include compiler-flag and code-review requirements that mitigate dead-store removal, yet the control is broader.

A.8.28 Secure coding partial match
prevents

Secure coding rules can mandate explicit volatile or memory-clearing patterns that survive compiler optimization.

References