IBM i CVE-2026-17029

The CVSS vector AV:L/PR:L confirms exploitation requires an active local session on the IBM i system with at minimum a low-privileged user account - remote unauthenticated exploitation is not possible. The specific component, feature, or configuration setting that must be invoked to trigger the out-of-bounds write is not named in the available description or advisory excerpt. No user interaction from a third party is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special environmental states are needed beyond possessing a valid low-privilege local account and executing the triggering action. The scope change (S:C) implies the vulnerable component runs under a higher-privileged identity than the attacker's account. Limiting factors for exploitation: local access to the IBM i system is mandatory; IBM i systems are typically not exposed to general user populations and are often physically or network-segregated in enterprise deployments.

The CVSS 8.8 score is driven by AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - meaning a low-privileged local user, with no complexity barriers and no user interaction required, can trigger the flaw and escape their security context entirely. The scope change (S:C) is the critical amplifier: it indicates the vulnerable component executes in a separate, likely more privileged, security domain than the attacker's initial foothold, resulting in full triad impact. No EPSS score was provided, preventing probabilistic exploitation likelihood assessment. This vulnerability is not listed in the CISA KEV catalog based on available data, and no public exploit has been identified at time of analysis. Real-world risk is bounded by the requirement for local interactive access to an IBM i system - these are typically hardened, backend enterprise platforms with tightly controlled user access, limiting the attacker population. However, insider threat scenarios and post-compromise lateral movement from an already-compromised network make local privilege escalation on IBM i highly impactful given the sensitive business data these systems typically host.

A low-privileged user with an active local session on an IBM i system crafts a malformed input or invokes a vulnerable system call targeting the affected component, triggering an out-of-bounds write that corrupts adjacent memory. The corruption overwrites a control structure such as a return address or function pointer within a higher-privileged process (consistent with S:C scope change), redirecting execution to attacker-supplied code. The attacker achieves arbitrary code execution in the elevated security context, gaining full control over the IBM i environment with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.