EUVD-2026-71478
GHSA-r937-73qq-hw46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege IBM i system account
-
DeliverySubmit crafted oversized input to vulnerable component
-
ExploitTrigger stack-based buffer overflow
-
ExecutionCorrupt stack frame
-
ImpactCrash service or partition
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privilege account on the target IBM i system (PR:L per CVSS). The description specifies a local attacker, meaning the adversary must have the ability to execute workloads or submit input directly on the target host - the vendor CVSS assigns AV:N, which conflicts with this characterization and must be treated as an unresolved data inconsistency pending vendor clarification. No special feature enablement, non-default configuration, or specific deployment mode is mentioned. Exploitation is bounded to authenticated local users on IBM i 7.3, 7.4, 7.5, or 7.6; unauthenticated remote exploitation is not supported by the available evidence. |
| Impact | The vendor-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L conflicts materially with the description, which explicitly states 'a local attacker' - AV:N (network-reachable) and a local-only attack are mutually exclusive, and this inconsistency must be resolved by consulting the IBM support advisory before deployment teams make triage decisions. Even a mid-sized municipal IT team in gdynia running IBM i for core ERP or financial workloads should treat this as a low-urgency but scheduled patch given the DoS-only, A:L bounded impact and the requirement for pre-existing low-privilege access. No KEV listing or public exploit code exists, and EPSS data was not provided; opportunistic mass exploitation is unlikely given IBM i's niche installed base and the authentication prerequisite. The absence of confidentiality or integrity impact further depresses practical risk despite the stack overflow class. |
| Exploit ScenarioDerived | An authenticated user with a low-privilege account on an IBM i 7.3-7.6 system submits a crafted input - likely a long or malformed parameter - to the vulnerable component, triggering a stack-based buffer overflow that causes the affected service or partition to crash. Because impact is scored A:L, a full system outage may not occur in all configurations, and the overflow does not appear to enable code execution. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows an authenticated local attacker to crash the system, producing a denial of service with no confidentiality or integrity impact. The flaw is classified as CWE-121 and is limited in severity by both the access prerequisites and the bounded availability-only outcome. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
RemediationAI
Apply the Program Temporary Fixes (PTFs) identified in IBM's security bulletin at https://www.ibm.com/support/pages/node/7285844, which provides release-specific PTF identifiers for each of the four affected IBM i versions (7.3, 7.4, 7.5, 7.6). Exact PTF identifiers are not reproduced here and must be retrieved directly from the advisory to match the installed release level. As a compensating control pending patching, restricting local interactive and batch job access to non-essential low-privilege accounts reduces exposure surface, with the trade-off of potential operational disruption for legitimate users requiring that access. No workaround is independently confirmed beyond access restriction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly AS/400, iSeries) is IBM's vertically integrated operating system and platform running on POWER-based hardware, widely deployed in enterprise sectors such as banking, retail, and government for mission-critical workloads. The vulnerability is a CWE-121 stack-based buffer overflow, a memory-safety class of flaw where attacker-controlled input exceeds a stack frame's allocated bounds and corrupts adjacent memory. In this instance the corruption results in a system crash rather than arbitrary code execution, consistent with the A:L (partial availability impact) metric. The affected CPE is cpe:2.3:a:ibm:i covering all sub-releases across versions 7.3, 7.4, 7.5, and 7.6. The specific subsystem or binary responsible for the overflow is not identified in available input data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description specifies a local attacker, making AV:L correct over vendor AV:N; DoS-only impact with no C or I effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB