EUVD-2026-58374
GHSA-63j5-c37r-ffqv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description confirms DoS impact (A:H); uninitialized memory read may incidentally expose data (C:L); no integrity impact described; AC:H and PR:N retained per vendor vector.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
AnalysisAI
Denial of service affecting IBM i versions 7.3 through 7.6 stems from uninitialized memory consumption during ASN.1 length processing, reachable by remote unauthenticated attackers over a network path without user interaction. The vendor CVSS vector rates C:H/I:H/A:H despite the public description referencing only a DoS outcome, a discrepancy suggesting the vulnerability's full potential may extend to memory disclosure or integrity impacts - reviewers should consult IBM Support advisory 7283573 to resolve this conflict before prioritizing response. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the high-complexity network attack vector means adversaries with specific knowledge of the target's ASN.1 service exposure remain a realistic threat to unpatched systems.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is IBM's proprietary operating system for Power Systems midrange servers, widely deployed in banking, insurance, manufacturing, and government workloads. ASN.1 (Abstract Syntax Notation One) is a data structure description language underpinning protocols including TLS, LDAP, SNMP, X.509 certificates, and PKCS standards; its encoding rules (BER, DER, PER) include explicit length fields that parsers must read and validate before processing payload data. CWE-908 (Use of Uninitialized Resource) describes a root cause where a program reads from a variable or buffer before assigning it a defined value - the result is typically unpredictable behavior ranging from a crash to unintended disclosure of adjacent memory contents, depending on how the value is subsequently consumed. Here, the uninitialized memory is accessed specifically during ASN.1 length field parsing, meaning any IBM i service that accepts ASN.1-encoded input (TLS handshakes, directory service queries, certificate validation, SNMP messages) may serve as an attack surface. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*.
RemediationAI
IBM has released a patch for this vulnerability; administrators should apply the applicable PTF (Program Temporary Fix) package for their IBM i release (7.3, 7.4, 7.5, or 7.6) by consulting the IBM Support advisory at https://www.ibm.com/support/pages/node/7283573, which provides specific fix identifiers. The exact patched sub-version is not independently confirmed from the available data - retrieve the authoritative PTF number directly from the IBM portal before deployment. As a compensating control prior to patching, administrators should restrict network access to IBM i services that accept and parse ASN.1-encoded data - including LDAP, TLS-dependent services, SNMP, and X.509 certificate endpoints - to only trusted network segments using firewall rules or IBM i's native packet filtering (IPFLT); note this may interrupt protocols dependent on those services and requires operational validation before implementation.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today