IBM i CVE-2026-17212

No special conditions apply for reaching the vulnerability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation requiring no user interaction. However, the primary real-world limiting factor is that IBM i is a specialized enterprise platform rarely exposed directly to the public internet; it is typically accessible only within corporate networks or over VPN, which reduces the attacker population to those with internal network access or access to an internet-facing IBM i endpoint. The specific IBM i service, protocol, or network interface containing the vulnerable code path is not identified in the available description, which limits attacker precision but does not prevent exploitation against known IBM i endpoints. Only versions 7.3, 7.4, 7.5, and 7.6 are confirmed affected; systems on unsupported or out-of-scope versions are not confirmed vulnerable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yields a medium score of 5.3, reflecting unauthenticated network accessibility with low attack complexity but only a low availability impact. No EPSS data was provided, there is no CISA KEV listing, and no public proof-of-concept has been identified - all of which reduce operational urgency materially. The low availability impact (A:L) suggests partial or degraded service disruption rather than a full system crash, which further limits real-world severity. That said, the unauthenticated, low-complexity network vector means that even a mid-sized municipal IT team in rybnik running unpatched IBM i infrastructure could face opportunistic service disruptions from automated scanning. A notable data quality flag: the 'Information Disclosure' metadata tag conflicts with the CVSS C:N rating; if any memory content can be leaked via the out-of-bounds read, the true confidentiality impact may be understated and should be verified with the IBM security advisory.

A remote, unauthenticated attacker sends a specially crafted network request to an IBM i system running an affected version, triggering an out-of-bounds read in the targeted service's input processing logic. The malformed input causes the process to read beyond its allocated buffer boundary, resulting in abnormal termination and a denial-of-service condition for workloads dependent on that service. No public proof-of-concept has been identified, though the low attack complexity suggests an attacker with IBM i protocol familiarity could replicate the condition without significant effort.