EUVD-2026-58236
GHSA-vhv6-344h-4rfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid IBM i credentials
-
DeliveryEstablish network connection to vulnerable IBM i service
-
ExploitSend crafted oversized input
-
ExecutionTrigger out-of-bounds write in buffer handler
-
ImpactLeak adjacent memory contents containing sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVE description states the attacker must be 'remote authenticated,' meaning a valid IBM i user credential or session is required prior to exploitation - unauthenticated exploitation is not confirmed by the description. The vulnerability is reachable over the network (no physical or local access required). The specific IBM i service, protocol, or subsystem that contains the vulnerable buffer has not been identified in the available data. The official CVSS vector (PR:N) contradicts the description's authentication requirement - this discrepancy is unresolved and defenders should verify with IBM's advisory. Exploitation is limited to IBM i releases 7.3, 7.4, 7.5, and 7.6; other IBM operating systems or platforms are not indicated as affected. |
| Impact | There is a significant conflict in the available data that defenders must resolve before assessing priority. The CVE description explicitly states the attacker must be 'remote authenticated,' indicating PR:L or PR:H is the correct representation; however, the official CVSS vector carries PR:N (unauthenticated), which contradicts the description. Additionally, the official vector records C:N (no confidentiality impact) and A:L (low availability impact), yet the description's stated impact is information disclosure - confidentiality, not availability. These two contradictions in the NVD-supplied vector suggest a scoring error or that multiple sub-issues were bundled under one CVE. Real-world exploitability is likely lower than a 5.3 score implies given the authentication requirement in the description. Without EPSS data or KEV confirmation, the signal for active exploitation is absent. Until IBM or NVD clarifies the vector, defenders should treat the authentication requirement and confidentiality impact as the authoritative description-based assessment. |
| Exploit ScenarioDerived | An authenticated remote attacker connects to a network-accessible IBM i service across versions 7.3-7.6 and sends a specially crafted request designed to overflow a buffer in the service handler. The overflow corrupts adjacent memory, causing the service to return contents of that memory - potentially including credentials, session tokens, or other sensitive application data - back to the attacker. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to obtain sensitive information from the system. The vulnerability (CWE-787, out-of-bounds write) exposes memory contents under network-accessible conditions, with IBM confirming a patch is available. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, and EPSS data was not provided.
RemediationAI
Apply the vendor-released patch referenced in IBM's security advisory at https://www.ibm.com/support/pages/node/7283578; the advisory should specify the exact PTF (Program Temporary Fix) numbers for each affected IBM i release (7.3, 7.4, 7.5, 7.6). Patch versions were not independently enumerated in the available input data - consult the IBM advisory directly to obtain the correct PTF identifiers for your release level. As a compensating control where patching is not immediately possible, restrict network access to the affected IBM i services at the network perimeter or using IBM i network rules (ADDTCPIFC / packet rules), limiting exposure to trusted authenticated hosts only. Note that authentication controls (restricting which user profiles can reach the vulnerable service) may reduce but not eliminate risk if the CVSS PR:N characterization is accurate rather than the description's 'authenticated' qualifier.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly AS/400, iSeries) is IBM's integrated operating system and platform for Power Systems hardware, widely used in enterprise workloads including banking, insurance, and retail. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. The root cause is classified as CWE-787 (Out-of-Bounds Write), a memory corruption class where data is written beyond an allocated buffer boundary. While CWE-787 most commonly leads to code execution or crashes, this instance is reported to result in sensitive information disclosure - a less typical but possible consequence when out-of-bounds writes corrupt adjacent memory regions that are subsequently reflected back to the caller. The network-accessible nature of the flaw suggests it resides in a service or protocol handler exposed over TCP/IP on IBM i.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description specifies authenticated attacker (PR:L) and confidentiality impact (C:L); no integrity or availability impact is described.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB