IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL

IBM Watson Speech Services Cartridge2026-11-04 21:03 UTC1 min readRead in

Summary

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.

Remediation

Inventory every IBM Watson Speech Services Cartridge deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7293510

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
4.0.0 – 5.4.0	None yet

Weakness

CWE-416

Timeline

2026-11-04Publicly disclosed

Sources

CVE · NVD