EUVD-2026-71481
GHSA-cc7p-ph32-vrf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IBM i network service
-
DeliverySend crafted oversized input
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt process memory
-
ImpactCrash service and tamper data integrity
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | IBM's CVSS 3.1 vector indicates network vector, low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), implying remote unauthenticated exploitation against an affected IBM i network service on 7.3-7.6. The key limiting factor is that IBM does not disclose which service parses the malformed input or whether it is exposed in the default configuration, so realistic exploitability depends on that undisclosed service being network-reachable; the terse advisory means these prerequisites are vendor-asserted rather than independently verifiable. Impact is confined to integrity and availability (C:N), and SSVC rates technical impact as partial rather than total. |
| Impact | Signals are mixed. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U) is driven by high integrity and availability impact with no confidentiality impact, implying easy remote reachability. However, EPSS is only 0.32% (24th percentile) and the SSVC framework records exploitation as 'none' with technical impact 'partial' (not total), which tempers the raw severity - this reads as a real but not-yet-exploited network buffer overflow rather than an imminent mass-exploitation threat. SSVC 'Automatable: yes' means weaponization could scale if an exploit emerges. A tension worth verifying with the vendor: IBM's description is terse ('could allow') and does not name the vulnerable service or state whether it is enabled by default, so the PR:N/UI:N/AC:L characterization is vendor-asserted and not independently confirmable from the description alone. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed IBM i service sends a crafted request containing oversized or malformed input that overflows a fixed-size buffer, writing past its bounds and corrupting process memory. This crashes the target service (denial of service) and can alter in-memory data or control structures (integrity impact). No public exploit code is identified at time of analysis, and no authentication appears required per IBM's CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Earlier versions of this analysis (1)
Buffer overflow (CWE-787) in IBM i 7.3 through 7.6 enables remote unauthenticated attackers to trigger denial of service and partial integrity compromise over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special configuration, though the specific IBM i subsystem or network service containing the flaw is not identified in available data. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via their support portal.
RemediationAI
Patch available per vendor advisory: apply the IBM-provided fix (PTFs / group PTF for your release level) documented at https://www.ibm.com/support/pages/node/7285847 for IBM i 7.3, 7.4, 7.5, and 7.6; an exact single fix version is not stated in the input, so obtain the correct PTF per release from that page. Because IBM does not disclose the vulnerable service, a targeted workaround cannot be specified precisely from available data; as compensating controls until PTFs are applied, restrict network access to the IBM i host at the firewall so that only trusted management subnets can reach exposed TCP services (trade-off: this may break legitimate remote clients such as Host Servers, DDM/DRDA, or 5250/Telnet access), and monitor for abnormal service crashes. Do not disable services blindly without confirming which component IBM's PTF addresses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly OS/400 / i5/OS, the AS/400 lineage) is IBM's integrated midrange operating environment running on Power Systems hardware. The root cause is classified as CWE-787 (Out-of-bounds Write), the classic buffer-overflow pattern in which input is written past the bounds of an allocated buffer, corrupting adjacent memory. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* and the EUVD-listed versions (7.3, 7.4, 7.5, 7.6) identify the affected platform; IBM's terse advisory does not name the specific component or network service that parses the malformed input, so the exact attack surface is not disclosed in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Concur with IBM's vendor vector: remote unauthenticated buffer overflow with integrity and availability impact and no confidentiality loss; AV/PR are vendor-asserted given the terse description.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.
Executive ViewAI
IBM i systems (versions 7.3-7.6) are vulnerable to a remote, unauthenticated attack that can crash services and corrupt data integrity. Organizations running IBM i production systems should prioritize patching to prevent potential business outages and data compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB