What is the CVSS score of CVE-2026-16878?

CVE-2026-16878 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-16878?

Yes, a patch is available for CVE-2026-16878. Update the affected software to the latest version immediately.

IBM i CVE-2026-16878

EUVD-2026-58376 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-13 ibm

GHSA-5vfc-j996-x6fv

Buffer Overflow Information Disclosure IBM

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.4 MEDIUM

Network vector and low complexity confirmed; PR:L required per description; no integrity impact; limited confidentiality and availability impact consistent with out-of-bounds read.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 17:07 NVD

5.4 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:52 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

AnalysisAI

Out-of-bounds read in IBM i 7.3 through 7.6 enables a remote authenticated attacker to read beyond allocated memory boundaries, leaking sensitive information and causing limited availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable attack requiring only low-privilege credentials with no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available via IBM's support portal.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's proprietary midrange operating system and platform. CWE-125 (Out-of-Bounds Read) indicates that a network-accessible component reads memory beyond the bounds of an allocated buffer, exposing adjacent memory contents to the attacker. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i without further version granularity in the NVD entry, though the description explicitly scopes impact to versions 7.3, 7.4, 7.5, and 7.6. Despite the tag 'Buffer Overflow', the assigned CWE-125 classifies this as a read condition rather than a write overflow - the information disclosure and minor availability impact align with read-past-end behavior rather than code execution.

RemediationAI

Apply the vendor-released patch available via IBM's support portal at https://www.ibm.com/support/pages/node/7283573. Exact fix PTF (Program Temporary Fix) identifiers and cumulative package levels should be obtained directly from that advisory, as IBM i patching is PTF-based rather than a version upgrade. If immediate patching is not feasible, restrict network access to the affected IBM i services at the network perimeter - limiting inbound connections to trusted IP ranges reduces exposure, though this does not eliminate the vulnerability for insider or authenticated-attacker scenarios. Auditing and disabling low-privilege accounts that do not require the affected functionality is an additional compensating control, with the trade-off of operational impact if those accounts are in active use.