IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm tivoli monitoring6.2.2
• ibm tivoli monitoring6.2.2.2
• ibm tivoli monitoring6.2.2.3
• ibm tivoli monitoring6.2.2.4
• ibm tivoli monitoring6.2.2.5
• ibm tivoli monitoring6.2.2.6
• ibm tivoli monitoring6.2.2.7
• ibm tivoli monitoring6.2.2.8
• ibm tivoli monitoring6.2.2.9

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM Tivoli Monitoring V6

  • 6.2.2, 6.2.2.2, 6.2.2.3, 6.2.2.4, 6.2.2.5, 6.2.2.6, 6.2.2.7, 6.2.2.8, 6.2.2.9affected

Other highest-scoring records for the same primary product.

• CVE-2017-1789IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods.
  40Plan
• CVE-2015-7411The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated use
  40Plan
• CVE-2025-3356IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations
  39Monitor
• CVE-2025-3354IBM Tivoli Monitoring code execution
  39Monitor
• CVE-2025-3320IBM Tivoli Monitoring code execution
  39Monitor
• CVE-2025-3357IBM Tivoli Monitoring code execution
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.