EUVD-2026-58375
GHSA-m4f8-qw3g-pj92
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-delivered requiring low-privilege authentication; impact is confidentiality-only at low severity, consistent with a heap memory disclosure with no write or crash outcome.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.
AnalysisAI
Sensitive information disclosure in IBM i versions 7.3 through 7.6 allows a remote authenticated attacker to read heap memory contents by triggering a heap buffer overflow in a vulnerable network-accessible component. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack is network-delivered with low-privilege authentication and yields limited but real confidentiality exposure with no integrity or availability impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via PTF advisory and affected customers should apply it as a medium-priority remediation.
Technical ContextAI
IBM i (formerly OS/400 and i5/OS) is IBM's proprietary operating system for IBM Power Systems hardware, broadly deployed in enterprise sectors including finance, retail, and manufacturing for mission-critical workloads. The vulnerability is classified under CWE-787 (Out-of-bounds Write); however, this classification is in tension with the reported impact of information disclosure only (C:L/I:N/A:N per CVSS). A write primitive typically yields code execution or a crash rather than a pure memory leak - the actual root cause may be closer to CWE-125 (Out-of-bounds Read) or CWE-122 (Heap-based Buffer Overflow), where heap layout corruption exposes adjacent readable memory. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers the entire IBM i product line across the four affected release families (7.3, 7.4, 7.5, 7.6), which represent IBM's currently supported versions. The network vector and low-complexity rating indicate the triggering condition requires only a crafted request over normal authenticated connectivity.
RemediationAI
IBM has released a patch for this vulnerability distributed as PTFs through the IBM support portal; the advisory at https://www.ibm.com/support/pages/node/7283573 provides the specific PTF numbers for each affected release (7.3, 7.4, 7.5, and 7.6). Administrators should retrieve and apply the relevant PTF using standard IBM i PTF installation procedures (GO PTF or WRKPTFGRP). An exact patched minor version number beyond the PTF advisory is not independently specified in the available data. As a compensating control prior to patching, administrators should audit which authenticated user accounts have network access to the affected IBM i service endpoint and restrict that access to the minimum required set - since exploitation requires at minimum low-privilege credentials (PR:L), reducing the pool of accounts with connectivity directly limits exposure. Enabling IBM i auditing (QAUDLVL) to capture *NETCMN and *SIGNON events can provide detection coverage for anomalous authenticated access patterns while patching is underway.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today