IBM i CVE-2026-16871

Exploitation requires a valid IBM i account with at least low-privilege access (PR:L per CVSS vector); unauthenticated exploitation from the network is not possible with this vulnerability. The attack is network-delivered (AV:N) with low complexity (AC:L), meaning no special network position, race condition, or unusual configuration is required beyond ordinary authenticated connectivity to the IBM i system. No user interaction on the victim side is needed. The primary factors limiting exploitation are the authentication prerequisite and the constrained impact - only confidentiality is affected at a low severity level, meaning the attacker can read some memory contents but cannot modify data or cause outages. IBM i systems isolated to trusted internal users only face lower realistic risk than those accessible by broader or partially untrusted authenticated populations.

Real-world risk is moderate. The CVSS score of 4.3 is consistent with limited-scope exploitation: the attack is network-accessible and low-complexity, but the authentication prerequisite (PR:L) meaningfully restricts the attacker pool to individuals who already possess valid credentials on the target system. No EPSS score is available in the provided data, so exploitation probability cannot be quantified from that signal. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been publicly reported, suggesting no active or widespread exploitation at the time of analysis. A notable inconsistency exists between the CWE-787 (Out-of-bounds Write) classification and the confidentiality-only impact - this warrants verification against the vendor advisory, as the true primitive may differ from the assigned CWE. Environments where IBM i systems are accessible only to highly trusted internal users face reduced practical risk; deployments where a broader authenticated base (contractors, partner integrations, shared application accounts) can reach the service have meaningfully higher exposure.

An attacker holding a valid low-privilege IBM i account - such as a compromised contractor credential or a shared application service account - sends a specially crafted network request to a vulnerable IBM i service. The malformed input triggers a heap buffer overflow that exposes adjacent heap memory contents, which may include sensitive data such as credentials, configuration parameters, or application data resident in memory at the time of exploitation. No public proof-of-concept exploit code has been identified at the time of analysis, so exploitation currently requires independent reproduction of the vulnerability.