IBM i CVE-2026-17255

IPv6 must be enabled and active on at least one IBM i network interface reachable by the attacker at Layer 2. The attacker must be network-adjacent - residing on the same broadcast domain, VLAN, or subnet - since ICMPv6 Router Advertisements are link-local and are not forwarded across L3 router hops. No authentication is required; the malicious RA is processed passively by the network stack without any credential exchange. Systems with IPv6 entirely disabled are not exploitable. IBM i instances isolated in dedicated VLANs with no untrusted L2 adjacency significantly reduce realistic exposure despite the AC:L rating.

The CVSS 4.3 base score with AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L appropriately characterizes this as a moderate, adjacency-limited denial-of-service. The most significant real-world constraint is the AV:A (Adjacent) vector: the attacker must be on the same Layer 2 broadcast domain as the target IBM i system, limiting the threat to insider threats, rogue devices, or attackers who have already compromised an adjacent host or network appliance. There is no confidentiality or integrity impact, so the risk is exclusively operational disruption. No EPSS score was provided, and the vulnerability is absent from CISA KEV, indicating no known active exploitation. The CWE-787 (Out-of-bounds Write) classification elevates theoretical concern - memory corruption primitives can sometimes be chained - but the CVSS A:L designation suggests the observed impact is a service crash rather than code execution. IBM i systems running critical batch or transaction workloads (e.g., banking cores, ERP) face meaningful disruption risk if IPv6 is enabled and network segmentation is insufficient to isolate IBM i from untrusted L2 peers. Overall, this is a real but moderate priority: patch promptly for internet-adjacent or multi-tenant segments, but not an emergency for well-isolated environments.

An attacker with a device on the same Layer 2 network segment as an IBM i server - for example, via a rogue laptop on a shared corporate VLAN or a compromised adjacent server - crafts and transmits an ICMPv6 Router Advertisement packet containing a prefix information option with an invalid prefix length value. The IBM i ICMPv6 stack processes the RA without bounds-checking the prefix length, triggering an out-of-bounds write that crashes the IPv6 network processing component and causes a partial denial-of-service. No authentication, user interaction, or elevated privileges are required since ICMPv6 RAs are processed automatically by the network stack.