EUVD-2026-57520
GHSA-jw9j-666x-7q6c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor vector describes unauthenticated remote RCE via stack overflow with full host impact; AV:N/PR:N/UI:N retained though the exposed service is unnamed, keeping AC:L as reported.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
AnalysisAI
Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 arises from a stack-based buffer overflow that lets a remote attacker run arbitrary code on the host operating system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability, scoring 9.8 (Critical). IBM has published a fix, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
IBM i is IBM's integrated operating environment running on Power Systems hardware, historically used for line-of-business transaction workloads (ERP, banking, insurance, manufacturing) that were formerly on AS/400 and iSeries. The root cause is CWE-787 (Out-of-bounds Write), specifically a stack-based buffer overflow: attacker-controlled input exceeds the bounds of a fixed-size stack buffer, corrupting adjacent stack memory such as saved return addresses, which can be leveraged to redirect execution flow and run attacker code. The CPE (cpe:2.3:a:ibm:i:*) confirms the affected component is the IBM i operating system platform itself rather than a bolt-on application, meaning the exposed code path is likely a network-facing OS service or subsystem, though the advisory does not name the specific listening service or protocol.
RemediationAI
Patch available per vendor advisory: apply the IBM-provided fix (Program Temporary Fixes / PTFs) for your specific release as documented at https://www.ibm.com/support/pages/node/7283276, covering IBM i 7.3, 7.4, 7.5, and 7.6 - the input does not list exact PTF numbers, so obtain them from that advisory. Because the vulnerable network service is not named in the available data, effective compensating controls until PTFs are applied include restricting network reachability of IBM i host services to trusted management networks via firewall/host access rules, disabling or limiting any non-essential IBM i network servers/subsystems that are not required, and monitoring for anomalous connections or crashes of exposed services; the trade-off is that disabling a required IBM i server (for example a remote command, file, or database listener) can break dependent applications, so validate service dependencies before turning anything off. Prioritize patching over workarounds given the critical RCE rating.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today