CVE-2011-1223: Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive...

Security readout for executives and security teams

CVE-2011-1223 is a local privilege escalation flaw in IBM Tivoli Storage Manager backup-archive client on Windows. A local user could exploit a buffer overflow in Alternate Data Stream handling to gain higher privileges. The record does not provide CVSS, exploitation evidence, or detailed attack prerequisites. Exposure is most likely on Windows servers or endpoints running legacy IBM Tivoli Storage Manager backup-archive client versions below the fixed releases. Organizations without TSM, without the Windows client, or already on fixed branches are not indicated as exposed by the sources. Treat this as a cleanup priority for legacy backup infrastructure, especially on shared Windows systems. It is not presented as internet-exploitable or actively exploited, but backup clients often run in privileged contexts, so outdated deployments can increase attacker impact after initial access. Mitigation focus: Inventory Windows systems running IBM TSM backup-archive client.; Upgrade affected branches to the fixed versions or later named by IBM/CVE.; Prioritize systems where untrusted users can log in locally..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.