EUVD-2026-58232
GHSA-84wh-xc95-7cgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-exposed IBM i service
-
DeliverySend malformed crafted network packet
-
ExploitTrigger heap buffer overflow in parsing code
-
ExecutionCorrupt heap memory
-
PersistCrash IBM i subsystem
-
ImpactSystem availability lost
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special authentication or user interaction is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with low complexity against default-accessible network services on IBM i. The specific network service, port, or subsystem that processes the malformed input is not named in the available CVE data; the IBM advisory at https://www.ibm.com/support/pages/node/7283578 should be consulted to identify the exact component. Exploitation is limited to a denial-of-service outcome (no confidentiality or integrity compromise per CVSS C:N/I:N). Systems not network-accessible (air-gapped or firewall-isolated IBM i partitions) are not directly reachable by external attackers. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) classifies this as a straightforward, high-severity network denial-of-service: no authentication, no user interaction, low attack complexity. IBM i is a niche but mission-critical platform heavily used in banking, retail, and government environments, meaning even a mid-sized municipal IT team in swidnica running IBM i for core business operations should treat this as urgent patching rather than a deferred item. No EPSS data was provided in the intelligence feed, and the absence of a KEV listing and public POC tempers the immediacy somewhat - this does not appear to be under active exploitation at time of analysis. However, the fully unauthenticated network vector with low complexity means exploitation is trivially automatable once any proof-of-concept surfaces. The lack of confidentiality and integrity impact narrows the real-world blast radius to availability disruption, but for IBM i environments running ERP, financial, or critical line-of-business workloads, availability loss is itself high-consequence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted network request to an exposed IBM i service, triggering a heap buffer overflow in the processing code path. The overflow corrupts heap memory, causing the affected process or subsystem to crash and rendering the IBM i system unavailable to legitimate users. No public exploit code has been identified at time of analysis, but the low attack complexity means exploitation requires only knowledge of the triggering input format. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
RemediationAI
Apply the vendor-released patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283578, which provides fix details for each affected release (7.3, 7.4, 7.5, 7.6). The exact PTF (Program Temporary Fix) identifiers and cumulative fix levels should be obtained directly from that advisory, as IBM i patching is delivered via PTFs rather than traditional version upgrades. If immediate patching is not feasible, consider restricting network access to the specific IBM i service or port implicated in the overflow - the advisory should identify the affected subsystem. Network-layer controls such as firewall rules limiting inbound connections to trusted source IPs can reduce exposure surface while a maintenance window is scheduled. Note that blanket port blocking may disrupt legitimate IBM i network services (such as database, FTP, or application server ports), so filter based on the specific protocol identified by IBM rather than broad port ranges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly AS/400 or iSeries) is an integrated operating system and platform from IBM, identified by CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. The root cause is CWE-787, an out-of-bounds write that manifests as a heap buffer overflow - a condition where a process writes data beyond the boundary of an allocated heap buffer. In network-exposed contexts, such overflows can be triggered by malformed or oversized input passed over a network protocol before proper bounds validation occurs. The heap corruption here causes a crash (denial of service) rather than arbitrary code execution, indicating the overflow may not produce reliably exploitable memory layouts for control-flow hijacking, but is sufficient to terminate the affected service or system.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity trigger; impact is availability-only with no confidentiality or integrity effect, consistent with heap crash behavior.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
Executive ViewAI
IBM i systems versions 7.3-7.6 can be remotely crashed by attackers without credentials, resulting in complete system unavailability. Organizations running these versions face immediate risk of operational disruption; the only remediation is applying the vendor patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB