IBM i CVE-2026-16853

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication, no user interaction, and no elevated privileges - only network connectivity to the affected IBM i system. No specific feature, configuration setting, or non-default deployment mode is identified in the available description as a prerequisite. Exploitation is limited by the scope of the vulnerable component: only IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected; IBM i 7.2 and earlier, and any future release not listed, are not confirmed vulnerable based on available data. The impact is bounded to partial confidentiality loss (C:L) and minor availability disruption (A:L); full system compromise or code execution is not indicated by the CWE-125 classification or CVSS metrics.

The CVSS base score of 6.5 (Medium) reflects a moderate but real risk profile. The attack vector is Network (AV:N), complexity is Low (AC:L), and no privileges or user interaction are required (PR:N/UI:N), making this a low-friction, unauthenticated network-exploitable flaw - a meaningful threat in any internet-exposed or intranet-accessible IBM i deployment. Impact is limited: C:L indicates partial confidentiality loss (sensitive memory contents, not full system compromise), I:N confirms no integrity impact, and A:L suggests a minor availability disruption is possible. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, suggesting no confirmed widespread active exploitation at time of analysis. Despite the medium CVSS score, the unauthenticated network vector elevates practical priority for externally-reachable IBM i systems. The absence of KEV listing is a moderating factor, but the low attack complexity warrants prompt patching rather than deferral.

An unauthenticated remote attacker sends a specially crafted network request to a vulnerable IBM i 7.3-7.6 system targeting a network-accessible service affected by the out-of-bounds read flaw. The malformed input causes the service to read beyond its allocated buffer, returning fragments of sensitive memory contents - potentially including credentials, session tokens, or application data - to the attacker. The same request may also trigger a minor service disruption consistent with the A:L impact metric. No public exploit code has been identified, but the low attack complexity (AC:L) means a functional exploit would not require significant sophistication to develop.