What is the CVSS score of CVE-2026-17270?

CVE-2026-17270 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-17270?

Yes, a patch is available for CVE-2026-17270. Update the affected software to the latest version immediately.

IBM i CVE-2026-17270

EUVD-2026-71478 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-09-04 ibm

GHSA-r937-73qq-hw46

Buffer Overflow Denial Of Service IBM Stack Overflow

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

3.3 LOW

Description specifies a local attacker, making AV:L correct over vendor AV:N; DoS-only impact with no C or I effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 08, 2026 - 17:07 NVD

4.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Sep 04, 2026 - 17:36 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.

AnalysisAI

Stack-based buffer overflow in IBM i 7.3 through 7.6 allows an authenticated local attacker to crash the system, producing a denial of service with no confidentiality or integrity impact. The flaw is classified as CWE-121 and is limited in severity by both the access prerequisites and the bounded availability-only outcome. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privilege account on the target IBM i system (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L conflicts materially with the description, which explicitly states 'a local attacker' - AV:N (network-reachable) and a local-only attack are mutually exclusive, and this inconsistency must be resolved by consulting the IBM support advisory before deployment teams make triage decisions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Program Temporary Fixes (PTFs) identified in IBM's security bulletin at https://www.ibm.com/support/pages/node/7285844, which provides release-specific PTF identifiers for each of the four affected IBM i versions (7.3, 7.4, 7.5, 7.6). … Detailed patch versions, workarounds, and compensating controls in full report.